NULL Pointer Dereference in L2 GOOSE and R-GOOSE Parser in ICS Products
CVE-2026-50103

7.1HIGH

Key Information:

Vendor

Mz Automation

Status
Libiec61850
Vendor
CVE Published:
23 July 2026

What is CVE-2026-50103?

A vulnerability exists in the L2 GOOSE and R-GOOSE shared parser that allows a network-adjacent attacker to exploit a NULL pointer dereference. By sending a crafted GOOSE frame containing a malformed TLV value, an attacker could potentially crash a subscribing application, rendering it inoperable and creating a denial of service condition.

Affected Version(s)

libIEC61850 1.0.0 <= 1.6.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA
.