EUVD-2026-51358
GHSA-q8fp-56gr-h5jf
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent process-bus reach (AV:A), single unauthenticated frame with no interaction (AC:L/PR:N/UI:N), and out-of-bounds read causing crash only, so C:N/I:N/A:H.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
3DescriptionCVE.org
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap out-of-bounds read. On affected platforms, this condition reliably terminates the subscriber process and causes a denial-of-service.
AnalysisAI
Denial-of-service in an IEC 61850 GOOSE subscriber implementation allows an attacker with access to the substation process bus to crash the subscriber process using a single unauthenticated Layer-2 multicast frame. An off-by-one boundary error in the GOOSE parser triggers a heap out-of-bounds read (CWE-125) that reliably terminates the process. No public exploit identified at time of analysis; this is not listed in CISA KEV, and no EPSS score was provided.
Technical ContextAI
GOOSE (Generic Object Oriented Substation Event) is a core IEC 61850 messaging service used for fast, real-time protection and control signaling between intelligent electronic devices (IEDs) in electrical substations. GOOSE frames are transmitted as raw Layer-2 Ethernet multicast on the 'process bus' with no IP layer and no built-in authentication, so any device sharing that broadcast domain can send them. The root cause is CWE-125 (out-of-bounds read): while parsing specific GOOSE message fields, the parser advances its internal buffer pointer by one position too many, reading past the bounds of a heap allocation. Because the read lands outside valid memory, the subscriber process faults and exits. The affected component is the GOOSE subscriber/parser; the exact vendor product is enumerated in CISA ICS advisory ICSA-26-211-10, which is not fully reproduced in the provided data.
RemediationAI
Consult CISA advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) and the linked CSAF document for the vendor-released fixed version and apply it to all affected subscriber devices; no exact patch version was present in the provided data, so cite the version listed in that advisory rather than an assumed number. Because exploitation requires access to the Layer-2 process bus, the strongest compensating control is network segmentation: keep the process bus on a dedicated, physically isolated VLAN/switch fabric with no bridging to station-bus or corporate networks (trade-off: none for correctly architected substations, but retrofits may require rewiring). Enforce switch port security and 802.1X/MAC filtering on process-bus switches to prevent rogue devices from injecting frames (trade-off: added commissioning overhead). Where supported, enable GOOSE message validation/monitoring or an OT IDS to alert on malformed frames, and restrict physical access to substation networking equipment. Avoid disabling GOOSE subscription itself, as that would break protection and control functions.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today