Boundary Handling Flaw in GOOSE Payload Parser Affects Vendor Product

CVE-2026-66364

What is CVE-2026-66364?

The GOOSE payload parser contains a critical flaw related to boundary handling, which can be exploited by sending a specially crafted unauthenticated Layer 2 multicast frame on the process bus. This occurs when specific fields within the payload are processed, allowing an attacker to manipulate the inner element length so that it exceeds its expected enclosing limit. As a result, the parser performs an out-of-bounds read by one byte, which can lead to the reliable termination of the subscriber process and cause a denial-of-service condition. This vulnerability underscores the importance of robust input validation measures and vigilant monitoring of network traffic.

References