15 matches found
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the GOOSE payload parser. An attacker can cause the subscriber process to terminate by sending a specially crafted unauthenticated Layer 2 multicast frame with an attacker-controlled inner element length that...
EUVD-2026-51358
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...
CVE-2026-66369
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...
CVE-2026-66369
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...
CVE-2026-66369 MZ Automation libiec61850 Out-of-bounds Read
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...
CVE-2026-66364
CVE-2026-66364 affects the GOOSE payload parser (notably in the libiec61850/GOOSE implementation referenced by MZ Automation). The root cause is a boundary handling flaw: during processing of certain payload fields, an attacker-controlled inner element length may exceed its enclosing length, caus...
CVE-2026-66364 MZ Automation libiec61850 Out-of-bounds Read
The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over...
CVE-2026-66364
The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over...
PT-2026-66633
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GOOSE parser contains an off-by-one boundary-handling flaw triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific...
CVE-2026-66369: Out-of-bounds Read
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...
PT-2026-66627
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A boundary handling flaw exists in the GOOSE payload parser. An unauthenticated attacker can trigger this issue by sending a single Layer 2 multicast frame on th...
CVE-2026-50103
A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...
CVE-2026-50103
CVE-2026-50103 affects the GOOSE/R-GOOSE parser in libIEC61850 (MZ Automation) and describes a NULL dereference when parsing malformed TLV values, enabling a network-adjacent DoS by crashing the subscriber. The related PoCs and analysis in the connected documents confirm the issue and indicate fi...
CVE-2026-50103 Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850
A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...
