Medium severity · published Jul 30, 2026
CVE-2026-61893
MZ Automation lib60870 Out-of-bounds Read
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an
inflated object count causes TestCommand_getFromBuffer to read one byte
past the end of the heap-allocated message buffer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
lib60870 · MZ Automation
2.4.0 · source: vendor
In the news
VulnerabilityMedium
MZ Automation lib60870
View CSAF
Summary
Successful exploitation of these vulnerabilities could crash the device being accessed.
The following versions of MZ Automation lib60870 are affected:
lib60870 2.4.0 (CVE-2026-61893, CVE-2026-63033)
CVSS
Vendor
Equipment
Vulnerabilities
v3 6.5
MZ Automation GmbH
MZ Automation lib60870
Out-of-bounds Read
Background
Critical Infrastructure Sectors: Energy, Water and Wastewater, Critical Manufacturing, Chemical
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2026-61893
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.
View CVE Details
Affected Products
MZ Automation lib60870
Vendor: MZ Automation GmbH
Product Version: MZ Automation GmbH lib60870: 2.4.0
Product Status: known_affected
Remediations
Mitigation MZ Automation recommends users update to version 2.4.1 when available.
Vendor fix See MZ Automation advisories for more information: https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm
Relevant CWE: CWE-125 Out-of-bounds Read
Metrics
CVSS Version
Base Score
Base Severity
Vector String
...
Jul 30, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61893
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-11.json
github.com
https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11
More from lib60870
9.8
CVE-2024-45971
Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based…
9.8
CVE-2024-45970
Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based…
8.2
CVE-2026-16002
Out-of-bounds Read in MZ Automation lib60870
7.5
CVE-2021-45773
A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a segmentation fault or application crash
7.5
CVE-2021-21778
A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0