CVE-2026-19108

Medium

Description

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.

SeverityMedium

CVSS5.3

Exploit probability—

ProductMz Automation Libiec61850

PublishedAug 6, 2026

First seenAug 6, 2026

Weakness typeCWE-416Use after free CWE-119Memory buffer bounds error

How to fix

Patches

Affected products

Product	Affected versions	Fixed in
mz_automation libiec61850	1.6.0, 1.6.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.