{"id":"CVE-2026-66364","aliases":["EUVD-2026-51341","GHSA-hw99-2wcp-34xq"],"status":"published","title":"MZ Automation libiec61850 Out-of-bounds Read","description":"The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00285,"percentile":0.21185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-07-30T22:33:28Z","modified":"2026-09-03T17:58:18Z","products":[{"vendor":"mz automation","product":"libiec61850"},{"vendor":"mz automation gmbh","product":"libiec61850"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66364"},{"url":"https://github.com/advisories/GHSA-hw99-2wcp-34xq"}],"sources":{"cve":[{"id":"CVE-2026-66364","title":"MZ Automation libiec61850 Out-of-bounds Read","description":"The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition.","status":"published","published":"2026-07-30T22:33:28.104Z","modified":"2026-07-31T15:55:15.546Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-51341","description":"The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition.","status":"published","published":"2026-07-30T22:33:28Z","modified":"2026-07-31T15:55:15Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:25.856077Z"}],"ghsa":[{"id":"GHSA-hw99-2wcp-34xq","title":"The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single...","description":"The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition.","status":"published","published":"2026-07-31T00:30:22Z","modified":"2026-07-31T00:30:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:59.725505Z"}],"nvd":[{"id":"CVE-2026-66364","description":"The GOOSE payload parser contains a boundary handling flaw that can be \ntriggered by a single unauthenticated Layer 2 multicast frame on the \nprocess bus. When processing specific payload fields, an attacker \ncontrolled inner element length may exceed its enclosing length, causing\n the parser to over read by one byte. This out-of-bounds read reliably \nterminates the subscriber process, resulting in a denial-of-service \ncondition.","status":"published","published":"2026-07-30T23:16:53.223Z","modified":"2026-09-03T17:58:18.79Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}