CVE-2026-66364
MZ Automation libiec61850 Out-of-bounds Read
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting in a denial-of-service condition.
| CWE | CWE-125 |
| Vendor | mz automation gmbh |
| Product | libiec61850 |
| Published | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for mz automation gmbh libiec61850
Be the first to know when new medium vulnerabilities affecting mz automation gmbh libiec61850 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
MZ Automation GmbH / libiec61850
0 < 1.6.2
References
Credits
Arun Babu of Central Power Research Institute reported this vulnerability to CISA.