libiec61850 CVE-2026-66364

Exploitation requires the attacker to send a single crafted GOOSE (Generic Object Oriented Substation Event) Layer 2 multicast frame onto the IEC 61850 process bus - the same Ethernet broadcast domain as the target subscriber - with a payload where an inner element's declared length exceeds its enclosing container's length. No authentication, credentials, or user interaction are needed (PR:N/UI:N/AT:N). The primary limiting factor is the Adjacent attack vector (AV:A): the attacker must have Layer 2 access to the process-bus segment, so a properly isolated OT network without exposed process-bus ports substantially constrains reachability. The target must be running libiec61850 before 1.6.2 as an active GOOSE subscriber.

The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 7.1 and describes an adjacent-network, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity impact - an availability-only DoS. The Adjacent (AV:A) vector is the key limiter: the attacker must be able to inject Layer 2 multicast frames onto the same process-bus broadcast domain, which in properly segmented substations is a restricted OT network, not the internet. This is not a KEV entry and no POC is referenced, so exploitation is theoretical at this time. Note a data conflict: the intelligence tags include 'Information Disclosure,' but the description and the CVSS vector (VC:N) both indicate the out-of-bounds read only crashes the process and does not leak data - treat the info-disclosure tag as inaccurate for this CVE. Real-world priority is moderate-to-high specifically for OT/ICS operators because a subscriber crash can disrupt protection and control functions, but it is low for anyone whose libiec61850 use is not exposed to untrusted process-bus traffic.

An attacker with a foothold on the substation process-bus LAN (a rogue device, compromised IED, or malicious insider with switch access) crafts a single GOOSE multicast frame whose inner element length exceeds its enclosing length and broadcasts it on the bus. Every libiec61850 subscriber below 1.6.2 that parses the frame reads one byte out of bounds and crashes, disrupting protection/control signaling. No authentication and no user interaction are required, and low attack complexity means the crash is reliably reproducible; no public POC is currently referenced.