Dashboard / CVE-2026-19108

CVE-2026-19108

LOW
INFO Priority: 0.00 BB Relevance: 29/100
Published: 2026-08-06 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.

Weakness Classification (2)

References & Advisories (8)

Bug Bounty Relevance

29 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

1.9 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.16%
Raw Score 0.001590
Percentile 5.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00159
2026-10-28
0.00159

Intelligence Sources

nvd ref →

External Links