{"id":"CVE-2026-57446","aliases":[],"cve":{"records":[{"id":"CVE-2026-57446","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-24T13:21:20.730Z","published":"2026-10-16T15:46:33.549Z","modified":"2026-10-28T18:23:51.341Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-16T15:46:33.549Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-28T18:23:51.341Z"}],"references":[{"url":"https://github.com/mz-automation/libiec61850/security/advisories/GHSA-cxgr-7v9h-fj9p","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/mz-automation/libiec61850/security/advisories/GHSA-cxgr-7v9h-fj9p","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-415","description":"CWE-415: Double Free","source":"GitHub_M"},{"id":"CWE-664","description":"CWE-664: Improper Control of a Resource Through its Lifetime","source":"GitHub_M"},{"id":"CWE-672","description":"CWE-672: Operation on a Resource after Expiration or Release","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-28T18:23:43.634635Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.","score":5.3,"severity":"medium","published":"2026-10-16T15:46:33.549Z","modified":"2026-10-28T18:23:51.341Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"mz-automation","name":"libiec61850","platforms":[],"versions":[{"version":">= 1.6.1, < 1.6.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-57446"}],"remediation":[],"references":["https://github.com/mz-automation/libiec61850/security/advisories/GHSA-cxgr-7v9h-fj9p","https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd","https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2"],"sources":[{"name":"CVE","id":"CVE-2026-57446","modified":"2026-10-28T18:23:51.341Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-57446"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:40:24.226Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T19:20:33.887Z","attemptedAt":"2026-10-28T19:20:33.887Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T19:20:34.104Z","attemptedAt":"2026-10-28T19:20:34.104Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T19:20:33.889Z","attemptedAt":"2026-10-28T19:20:33.889Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T19:20:34.103Z","attemptedAt":"2026-10-28T19:20:34.103Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-57446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57446","modified":"2026-10-28T19:17:36.520","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-10-28T19:20:33.887Z"},{"source":"ENISA EUVD","id":"EUVD-2026-102909","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102909","modified":"Oct 28, 2026, 6:23:51 PM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-10-28T19:20:33.889Z"},{"source":"FIRST EPSS","id":"CVE-2026-57446","url":"https://www.first.org/epss/","probability":0.00401,"percentile":0.34229,"date":"2026-10-28","checkedAt":"2026-10-28T19:20:34.103Z"}],"aiSummary":{"text":"libIEC61850 versions 1.6.1 to 1.6.2 have a double free vulnerability in the MMS ObtainFile task, allowing remote crashes. The issue occurs when a task is reused and destination creation fails. Servers with MMS file service and ObtainFile enabled are affected.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:55:02.593Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-57446"}]}}