CVE-2026-63550

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read. This condition causes the MMS handling process to terminate unexpectedly, resulting in a denial-of-service.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El decodificador BER de MMS contiene una falla en el manejo de límites en el procesamiento de ciertos campos dentro de mensajes de solicitud confirmada. Cuando se recibe un elemento BER codificado y manipulado a través de una sesión MMS establecida (puerto TCP 102), el decodificador puede avanzar su posición de lectura interna incorrectamente, lo que lleva a una lectura fuera de límites de la pila. Esta condición causa que el proceso de manejo de MMS termine inesperadamente, lo que resulta en una denegación de servicio.

Information

Published : 2026-07-30 23:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-63550

Mitre link : CVE-2026-63550

CVE.ORG link : CVE-2026-63550

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-63550", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63550", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T15:55:55.366699Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "MZ Automation GmbH", "product": "libiec61850", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.2", "versionType": "custom"}, {"status": "unaffected", "version": "1.6.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T23:16:52.443", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "The MMS BER decoder contains a boundary-handling flaw in the processing \nof certain fields within confirmed-request messages. When a crafted \nBER-encoded element is received over an established MMS session (TCP \nport 102), the decoder may advance its internal read position \nincorrectly, leading to a heap out-of-bounds read. This condition causes\n the MMS handling process to terminate unexpectedly, resulting in a \ndenial-of-service."}, {"lang": "es", "value": "El decodificador BER de MMS contiene una falla en el manejo de l\u00edmites en el procesamiento de ciertos campos dentro de mensajes de solicitud confirmada. Cuando se recibe un elemento BER codificado y manipulado a trav\u00e9s de una sesi\u00f3n MMS establecida (puerto TCP 102), el decodificador puede avanzar su posici\u00f3n de lectura interna incorrectamente, lo que lleva a una lectura fuera de l\u00edmites de la pila. Esta condici\u00f3n causa que el proceso de manejo de MMS termine inesperadamente, lo que resulta en una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "ics-cert@hq.dhs.gov"}