CVE-2026-56758

CVE-2026-56758 is a heap over-read in MMS (Manufacturing Message Specification) stack AARQ/AP title parsing, triggered when the length value in the AP title field is zero or one. This causes the parser to read past buffer boundaries. The vulnerability requires an attacker to complete MMS connection establishment and specifically craft the AP title field — exploitation is not trivial and demands protocol knowledge that limits automated exploitation. The CVSS of 6.5 and low EPSS (0.00181) reflect this complexity, but these metrics miss the actual OT risk profile. In deployed ICS environments, MMS typically multiplexes with operator interfaces, engineering workstations, and historian connections over the same network paths. The more relevant question isn't 'will this be exploited' but 'what crashes when it triggers': a heap over-read in MMS processing can crash a PLC, and in continuous process environments that means an unplanned safety shutdown — a concrete operational consequence that may warrant patching priority beyond what CVSS suggests. The likely blast radius extends to every service sharing that network path. More importantly, this vulnerability almost certainly isn't isolated. The same length validation failure pattern exists in adjacent parsers within the same MMS stack — AARE response handling, ACSE services, other PDU types — and in vendor forks of MMS implementations across the ICS ecosystem. If you're maintaining an MMS stack, audit your AARQ response path and related PDU handlers for similar bounds check patterns. The patching question isn't whether to patch urgently; it's whether your network architecture treats MMS as trusted when it shares infrastructure with less-scrutinized services. Prioritize segmentation audits over pure CVSS-driven scheduling — that's where the actual exposure lies.

Reviewed through automated stages and approved by a human before publication.