A critical heap-based buffer overflow in the lib60870-C library poses a significant risk of remote code execution for applications using this component.

The library suffers from a heap-based buffer overflow due to insufficient validation of the residual capacity of the ASDU frame during FileSegment encoding, allowing an unauthenticated remote attacker to trigger memory corruption.

With a CVSS score of 9.8, this vulnerability is extremely severe. An attacker can exploit this memory corruption to crash services, cause system instability, or potentially execute arbitrary code, which could lead to a full takeover of the system running the affected library.

Immediate Action: Update lib60870-C to the latest version as provided by the maintainer.

Proactive Monitoring: Monitor for segmentation faults or abnormal service crashes that may indicate an ongoing exploitation attempt.

Compensating Controls: Deploy a WAF or an Intrusion Detection System (IDS) configured to inspect IEC 60870-5-104 traffic for malformed packets or anomalous segment sizes.

Public Exploit Available: Unknown.

Given the availability of a proof-of-concept and the critical nature of the buffer overflow, administrators should prioritize patching this library immediately. Verify all applications utilizing lib60870-C and ensure they are updated to a non-vulnerable release to prevent potential exploitation.