CVE-2026-63033

EUVD-2026-51361
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding
 what fits in the ASDU body causes InformationObject_ParseObjectAddress 
to read one byte past the end of the heap-allocated message buffer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
icscertCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mz-automationlib60870
2.4.0
CNA
Common Weakness Enumeration
References
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-11.json
https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11
https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7