libiec61850 EUVD-2026-48396

Exploitation requires the attacker to be network-adjacent - on the same Layer-2 broadcast domain for L2 GOOSE, or able to reach the routable multicast group for R-GOOSE - and requires a target application that is actively subscribing to and parsing GOOSE frames via libiec61850. The concrete trigger is a single crafted GOOSE frame containing a malformed TLV value that the shared parser mishandles; no authentication (PR:N), no user interaction (UI:N), and no special product configuration beyond having GOOSE subscription enabled are needed. Limiting factors: the attacker cannot reach the target remotely over the internet (AV:A restricts this to the local OT/substation network), and impact is confined to crashing the subscriber (availability only) with no code execution or data compromise.

The signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) shows exploitation requires only adjacent network access with low complexity, no authentication, and no user interaction - trivial to trigger for anyone on the substation LAN - but impact is strictly availability (VC:N/VI:N/VA:H), so there is no code execution, data disclosure, or integrity loss. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so this is not evidence of active or widespread exploitation. The real-world priority is elevated by context rather than by the raw score: GOOSE is used for protection signaling in power substations, so crashing a subscriber can disrupt safety-critical automation, and GOOSE by design is unauthenticated multicast Layer-2 traffic on an OT segment. Net assessment: not a mass-internet threat (adjacent-only, DoS-only), but meaningful for OT/ICS operators where availability of protection functions is paramount.

An attacker who gains a foothold on the substation LAN - via a compromised IED, engineering workstation, or a rogue device plugged into the process/station bus - crafts a GOOSE frame containing a malformed TLV and multicasts it onto the segment. Every subscribing application that parses the frame hits the NULL pointer dereference and crashes, disrupting protection or control functions. No exploit code is publicly identified, but the low attack complexity and lack of authentication make weaponization straightforward for an adversary already on the adjacent network.