Key points
- The flaw affects libiec61850 versions prior to 1.6.2.
- CVSS score is 8.2, rated as HIGH severity.
- A fix is available in version 1.6.2.
The open-source library libiec61850 requires an immediate update to version 1.6.2. This release addresses a high-severity vulnerability that allows remote attackers to crash servers. The issue exists in all versions released before 1.6.2 and impacts systems using the IEC 61850 protocol.
In plain English
The library contains a coding error in how it handles data references. When constructing a specific dataset reference, the code swaps the source and destination arguments for a string copy function. It treats uninitialized memory as a valid source string. This causes the system to read beyond the intended buffer limits on the stack. The result is corrupted data copied into another buffer, leading to a server crash.
The background
The vulnerability is tracked as CVE-2026-68907. The National Vulnerability Database assigns it a CVSS score of 8.2, which is classified as HIGH. The underlying weaknesses involve improper input validation and buffer over-reads. Attackers can trigger this by sending a remote defineNamedVariableList request. The crash occurs on servers that have the dynamic dataset service enabled and a dataset access handler installed.
What changes now
Developers and administrators must upgrade to version 1.6.2 to resolve the issue. The advisory confirms that this version fixes the argument reversal error. No other patches or workarounds are mentioned in the source material. Systems running older versions remain vulnerable to remote denial-of-service attacks. Users should verify their current version against the affected range.
Who needs to act first
Teams should prioritize updating systems that are directly accessible from untrusted networks. Check whether any servers expose the dynamic dataset service to external interfaces. Roll out the update to these exposed systems first to reduce immediate risk. Test the new version in a controlled environment before applying it to production. Back up configurations to ensure a quick recovery if issues arise during the upgrade process.
What to do and how to stay safe: libiec61850
- Identify all servers running libiec61850 versions older than 1.6.2.
- Verify if the dynamic dataset service is enabled on those servers.
- Restrict network access to these services if an immediate update is not possible.
- Monitor logs for unexpected crashes or defineNamedVariableList requests from unknown sources.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The CVSS score is 8.2, which is rated as HIGH severity.
Which versions of libiec61850 are affected?
All versions prior to 1.6.2 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, the issue is fixed in version 1.6.2 of the library.
