Which versions of libiec61850 are affected by CVE-2026-66364?

MZ Automation libiec61850 versions before 1.6.2 are vulnerable to denial-of-service attacks that crash IEC 61850 subscriber processes used in critical industrial control and power infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-66364?

Within 24 hours, inventory all systems running libiec61850 versions prior to 1.6.2 and classify by criticality of role in process bus operations. Within 7 days, apply the vendor-released patch by upgrading all affected systems to libiec61850 version 1.6.2 or later, and implement mitigations detailed in CISA ICS advisory ICSA-26-211-10. Within 30 days, complete validation testing of patched systems in staging environments to confirm GOOSE parser stability, then coordinate with operations to stage production deployments, prioritizing mission-critical IEC 61850 subscriber nodes.

libiec61850 CVE-2026-66364

Q: What is the CVSS score of CVE-2026-66364?

CVE-2026-66364 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51341 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 icscert

GHSA-hw99-2wcp-34xq

Buffer Overflow Information Disclosure Libiec61850

7.1

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Requires Layer 2 process-bus access so AV:A; a single crafted frame with no auth or interaction gives AC:L/PR:N/UI:N; out-of-bounds read only crashes the process, so C:N/I:N/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Jul 30, 2026 - 23:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jul 30, 2026 - 23:21 vuln.today

Patch available

Jul 30, 2026 - 23:04 EUVD

DescriptionCVE.org

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting in a denial-of-service condition.

AnalysisAI

Denial-of-service in MZ Automation's libiec61850 (versions before 1.6.2) allows an unauthenticated attacker on the process bus to crash IEC 61850 subscriber processes with a single crafted GOOSE frame. The GOOSE payload parser mishandles nested length fields, so an inner element length that exceeds its enclosing length forces a one-byte out-of-bounds read (CWE-125) that reliably terminates the subscriber. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CISA ICS advisory (ICSA-26-211-10) and a vendor patch are available.

Technical ContextAI

libiec61850 is a widely used open-source C implementation of the IEC 61850 substation-automation protocol suite, including GOOSE (Generic Object Oriented Substation Event) messaging used for fast, time-critical protection and control signaling. GOOSE frames are Layer 2 Ethernet multicast messages published directly on the substation 'process bus' with no IP layer and no authentication by design. The vulnerability (CWE-125, out-of-bounds read) lives in the ASN.1/BER-style GOOSE payload parser, which decodes nested tag-length-value structures; a malformed frame in which an inner element's declared length exceeds its parent container's length causes the decoder to read one byte past the intended buffer boundary. The affected component is identified by CPE cpe:2.3:a:mz_automation_gmbh:libiec61850, confirming MZ Automation GmbH as the vendor.

RemediationAI

Vendor-released patch: upgrade libiec61850 to version 1.6.2 or later, which corrects the GOOSE parser boundary check; rebuild and redeploy any product or firmware that statically or dynamically links the library. Refer to CISA ICS advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) and its CSAF file for vendor guidance. Where immediate patching of embedded devices is not possible, apply compensating controls: strictly segment the process bus so only trusted publishers can send GOOSE multicast frames, using VLAN isolation and managed-switch port controls to keep the multicast domain closed - the trade-off is added switch configuration and the need to keep multicast group membership accurate. Enforce switch-level MAC/multicast filtering or IEC 62351-6 controls where supported, and monitor for malformed GOOSE frames and unexpected subscriber restarts; note these controls reduce exposure but do not fix the underlying parser flaw, so they are stopgaps until 1.6.2 is deployed.