Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-66364 EUVD-2026-51341GHSA-hw99-2wcp-34xq

MZ Automation libiec61850 Out-of-bounds Read

Published Jul 30, 2026 · Updated Jul 31, 2026 · Assigned by icscert

Description

The GOOSE payload parser contains a boundary handling flaw that can be
triggered by a single unauthenticated Layer 2 multicast frame on the
process bus. When processing specific payload fields, an attacker
controlled inner element length may exceed its enclosing length, causing
the parser to over read by one byte. This out-of-bounds read reliably
terminates the subscriber process, resulting in a denial-of-service
condition.

Affected products

VendorProductAffectedFixed
MZ Automation libiec61850 < 1.6.2 1.6.2

Advisories 1

References