CVE-2026-49035

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

Score

CVSS 4.0 9.2 Critical

Status

Deferred - ics-cert@hq.dhs.gov

Published

2026-07-23

Last modified

2026-10-24

Weaknesses

CWE-122

Affected products

• Libiec61850 (Mz Automation)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06