CVE-2026-63550
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read. This condition causes the MMS handling process to terminate unexpectedly, resulting in a denial-of-service.
Risk Assessment
An attacker can remotely crash the MMS handling process, disrupting communication in power automation systems and potentially causing power supply interruptions.
Recommendation
Install the update provided by the power automation system vendor that fixes the boundary-handling flaw in the MMS BER decoder.
Other vulnerabilities in MMS BER decoder
Original NVD description (English source)
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read. This condition causes the MMS handling process to terminate unexpectedly, resulting in a denial-of-service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS