CVE-2026-67873

EUVD-2026-53677
A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.85%
Common Weakness Enumeration
References
https://github.com/mz-automation/lib60870
https://github.com/mz-automation/lib60870/blob/master/user_guide.adoc
https://github.com/mz-automation/lib60870/issues/201
https://github.com/mz-automation/lib60870/releases/tag/v2.4.0
https://github.com/mz-automation/lib60870/issues/201