Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the GOOSE payload parser. An attacker can cause the subscriber process to terminate by sending a specially crafted unauthenticated Layer 2 multicast frame with an attacker-controlled inner element length that...

CVE-2026-66369

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...

CVE-2026-66369 MZ Automation libiec61850 Out-of-bounds Read

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...

CVE-2026-66369

The CVE-2026-66369 issue affects the GOOSE parser in the libiec61850 library used by MZ Automation. It is caused by an off-by-one boundary-handling flaw in the parser that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus, causing the parser to advance its in...

CVE-2026-66364 MZ Automation libiec61850 Out-of-bounds Read

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over...

PT-2026-66627

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A boundary handling flaw exists in the GOOSE payload parser. An unauthenticated attacker can trigger this issue by sending a single Layer 2 multicast frame on th...

EUVD-2026-35493

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes...

CVE-2019-16275

A vulnerability was discovered in wpasupplicant. When Access Point AP mode and Protected Management Frames PMF IEEE 802.11w are enabled, wpasupplicant does not perform enough validation on the source address of some received management frames. An attacker within the 802.11 communications range...