CVE-2026-67873

CRITICAL

CVE: CVE-2026-67873 - A heap-based buffer overflow exists in lib60870-C 2Sign in to save

CVSS

9.8

CVSS v3.1

EPSS

0.4%

Exploit Prediction Score

Published

August 6, 2026

Exploitability

EPSS probability 0.4%

Description

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data

Weaknesses

CWE-122

Affected Packages

No package data available.

Aliases

CVE-2026-67873

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/mz-automation/lib60870
https://github.com/mz-automation/lib60870/blob/master/user_guide.adoc
https://github.com/mz-automation/lib60870/issues/201
https://github.com/mz-automation/lib60870/releases/tag/v2.4.0