CVE-2026-57446 mz-automation CVE debrief

Who should care

Defenders responsible for IEC 61850 client and server protocol implementations, especially those using libIEC61850, should assess exposure and prioritize patching or mitigation. This includes operators of affected systems, security teams, and platform administrators who need to verify the presence of vulnerable versions and plan for remediation. Those managing IEC 61850-based systems should also review compensating controls and monitor for potential abuse.

Why it matters

Defenders should care about CVE-2026-57446 because it can cause remote crashes of servers with MMS file service and ObtainFile enabled, potentially disrupting IEC 61850-based systems. Affected versions require verification, and remediation priority is high.

• Remote crash of servers with MMS file service and ObtainFile enabled
• Potential disruption of IEC 61850-based systems
• Need for verification of affected versions and remediation status

Technical summary

The libIEC61850 library, which implements IEC 61850 client and server protocols, has a double-free vulnerability. This occurs when an MMS ObtainFile operation is successful but leaves a stale FILE* handle in a task. If another ObtainFile request reuses this task and fails to create a destination, it will close the stale FILE object again, causing a crash. The vulnerability can be triggered by a success-then-failure request sequence, allowing remote crashes of servers with MMS file service and ObtainFile enabled. Affected versions require verification, and remediation priority is high.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where IEC 61850 client and server protocols are used.

Recommended defensive actions

• Patch libIEC61850 to version 1.6.2 or later
• Disable ObtainFile in MMS file service if possible
• Monitor for suspicious MMS ObtainFile requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a successful MMS ObtainFile operation that closes MmsObtainFileTask::fileHandle but leaves a stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.