Security readout for executives and security teams
Plain-English summary
libIEC61850 1.4.0 contains an out-of-bounds read in a BER decoder used for MMS ASN.1 handling. The published record does not provide CVSS, affected downstream products, or confirmed business impact. Treat it as a memory-safety issue in systems that embed this library and process untrusted input.
Executive priority
Prioritize discovery first. The issue affects a specific library version, but severity and exploitation evidence are incomplete. Escalate remediation where the library is embedded in operational systems that parse untrusted traffic.
Technical view
CVE-2019-19944 is in BerDecoder_decodeUint32 in mms/asn1/ber_decode.c. The issue is tied to intLen and bufPos handling and can read beyond expected buffer bounds. The sources do not specify exploit prerequisites, crash behavior, data exposure, or fixed versions.
Likely exposure
Exposure is limited to software using libIEC61850 1.4.0, especially code paths decoding MMS ASN.1 BER data. The source bundle does not identify downstream vendors, products, CPEs, deployment patterns, or internet-exposed services.
Exploitation context
CISA KEV is false in the bundle, and no cited source confirms active exploitation. The public references identify the vulnerability and GitHub issue only. Exploitability, attacker position, and real-world abuse remain unconfirmed from the provided evidence.
Researcher notes
The record lacks CVSS, CWE, CPEs, fixed-version data, and exploit-status details. Analysis should focus on reachability of BerDecoder_decodeUint32, input trust boundaries, and whether downstream products statically bundle libIEC61850 1.4.0.
Mitigation direction
- Inventory applications and devices that embed libIEC61850 1.4.0.
- Check the upstream GitHub issue and vendor advisories for fixed versions or workarounds.
- Prioritize updates where untrusted MMS or BER input is processed.
- Restrict network access to affected services where operationally feasible.
- Monitor affected systems for crashes or abnormal parser failures.
Validation and detection
- Confirm whether libIEC61850 1.4.0 is present in source, binaries, or SBOMs.
- Trace whether BerDecoder_decodeUint32 is reachable from exposed or untrusted input paths.
- Review vendor firmware or application release notes for bundled libIEC61850 versions.
- Verify compensating controls limit access to services using MMS ASN.1 BER decoding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19944 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mz-automation/libiec61850/issues/196CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.