Off-by-One Boundary Flaw in GOOSE Parser Affects Vendor X's Control Systems
CVE-2026-66369
7.1HIGH
What is CVE-2026-66369?
The GOOSE parser is susceptible to an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. This flaw occurs during the processing of specific GOOSE message fields, where the internal buffer advancement is incorrectly managed. As a result, this condition can lead to a heap out-of-bounds read, reliably terminating the subscriber process and causing a denial-of-service on affected platforms.
Affected Version(s)
libiec61850 0 < 1.6.2
libiec61850 1.6.2
References
CVSS V4
Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Arun Babu of Central Power Research Institute reported this vulnerability to CISA.