CVE-2026-51219: lib60870 Heap Buffer Overflow Remote Denial of Service

Technical summary

CVE-2026-51219 is a heap buffer overflow (CWE-122) in the HighPriorityASDUQueue_hasUnconfirmedIMessages function within lib60870, a library commonly used in IEC 60870-5-104 protocol implementations for industrial automation and energy distribution systems. The vulnerability affects versions 2.3.3, 2.3.4, 2.3.5, and 2.3.6. A remote, unauthenticated attacker can send a malformed ASDU (Application Service Data Unit) message that causes out-of-bounds heap memory access, leading to process termination. The attack requires only network connectivity and no special privileges or user interaction.

Business impact

Organizations relying on lib60870-based systems for critical infrastructure, power grid operations, or industrial process control face disruption risk. A successful exploit causes denial of service, potentially interrupting real-time monitoring and control functions. In critical infrastructure contexts, even brief service loss can trigger cascading operational impacts. Affected vendors and integrators must prioritize assessment and remediation to maintain continuity and regulatory compliance (particularly for energy sector operators).

Affected systems

lib60870 versions 2.3.3 through 2.3.6 are directly vulnerable. Any application, device, or industrial control system integrating this library version is at risk. Common deployment contexts include SCADA systems, smart grid controllers, and power distribution automation platforms that implement IEC 60870-5-104 protocol communication. Organizations should inventory their lib60870 deployments and verify which versions are in production.

Exploitability

The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector, low complexity, and no authentication requirement. The barrier to exploitation is low: an attacker needs only to craft a malicious ASDU message and send it to a system running the vulnerable library. The attack is repeatable and does not depend on user interaction or special system state. However, the vulnerability has not been added to the CISA KEV catalog, suggesting either limited real-world exploitation activity or recent disclosure.

Remediation

Upgrade lib60870 to a patched version released after v2.3.6. Consult the vendor's advisory to identify the minimum safe version. If immediate patching is not feasible, implement network segmentation to restrict ASDU message traffic to trusted sources, and deploy anomaly detection to flag malformed IEC 60870-5-104 messages. Monitor affected systems for unexpected restarts or service interruptions as indicators of attack attempts.

Patch guidance

Contact your lib60870 vendor or integration partner to obtain a fixed version. Verify the release notes confirm the heap buffer overflow in HighPriorityASDUQueue_hasUnconfirmedIMessages is addressed. Test the patched library in a non-production environment with representative ASDU traffic before production deployment. For organizations with embedded or firmware-based deployments, coordinate with device manufacturers for firmware updates that include the patched library version.

Detection guidance

Monitor lib60870 process logs and system logs for segmentation faults (SIGSEGV on Unix/Linux) or access violations on Windows, particularly in timeframes correlating with network traffic anomalies. Network intrusion detection systems should flag oversized, malformed, or structurally invalid IEC 60870-5-104 ASDU messages. If you have visibility into heap memory operations, watch for heap corruption indicators preceding crashes. Log all ASDU messages received during suspected attack windows for forensic analysis.

Why prioritize this

This vulnerability warrants HIGH priority for any organization running lib60870 in production. The combination of unauthenticated remote access, low attack complexity, and direct denial of service impact on industrial control systems creates substantial operational risk. While not yet weaponized at scale (KEV not assigned), the attack surface is broad and remediation is straightforward (patching). In critical infrastructure or energy sectors, DoS threats warrant aggressive timeline acceleration.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects unauthenticated network-based access (AV:N) with low attack complexity (AC:L). The impact vector shows high availability loss (A:H) but no confidentiality or integrity compromise (C:N, I:N). The score appropriately captures the severity for availability-sensitive systems while acknowledging that data theft or tampering is not a concern. In industrial control environments, availability impact often translates to financial or safety consequences, potentially warranting risk elevation beyond the base score.

Frequently asked questions