PT-2026-66627 · Mz Automation Gmbh · Libiec61850

Arun Babu · CVE-2026-66364 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting in a denial-of-service condition.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-66364

Affected Products

Libiec61850

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-66364 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-211-10 · Note