Vulnerability · Published Jul 30, 2026 · Assigned by icscert
CVE-2026-66364MZ Automation libiec61850 Out-of-bounds Read
Medium 6.5
In plain English
A medium-severity out-of-bounds read in libiec61850 from MZ Automation GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting in a denial-of-service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MZ Automation GmbH | libiec61850 | 0 – before 1.6.2 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H