Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-66369 EUVD-2026-51358GHSA-q8fp-56gr-h5jf

MZ Automation libiec61850 Out-of-bounds Read

Published Jul 30, 2026 · Updated Jul 31, 2026 · Assigned by icscert

Description

The GOOSE parser contains an off-by-one boundary-handling flaw that can
be triggered by a single unauthenticated Layer-2 multicast frame on the
process bus. When specific GOOSE message fields are processed, the
parser advances its internal buffer position incorrectly, resulting in a
heap out-of-bounds read. On affected platforms, this condition reliably
terminates the subscriber process and causes a denial-of-service.

Affected products

VendorProductAffectedFixed
MZ Automation libiec61850 < 1.6.2 1.6.2

Advisories 1

References