Which versions of libiec61850 are affected by EUVD-2026-48396?

MZ Automation's libiec61850 library contains a high-severity denial-of-service vulnerability affecting IEC 61850 GOOSE protocol implementations that allows network-adjacent attackers to crash…

How to fix or mitigate EUVD-2026-48396?

Within 24 hours, inventory production systems using libiec61850 and identify those processing GOOSE or R-GOOSE traffic to assess operational criticality. Within 7 days, deploy network-layer defenses including L2 access controls to restrict GOOSE traffic sources to trusted segments and packet filtering rules targeting malformed TLV structures in GOOSE frames. Within 30 days, evaluate alternative protocol stacks or secured GOOSE variants, establish ongoing communication with vendor for security updates, implement automated health monitoring and process restart for critical subscribers, and develop emergency patching procedures for rapid deployment when vendor patches become available.

libiec61850 EUVD-2026-48396

Q: What is the CVSS score of EUVD-2026-48396?

EUVD-2026-48396 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-50103 HIGH

Improper Handling of Syntactically Invalid Structure (CWE-228)

2026-07-23 icscert

GHSA-mg79-w9qx-hwj2

Denial Of Service Libiec61850 Mz Automation

7.1

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent unauthenticated single-frame trigger gives AV:A/AC:L/PR:N/UI:N; impact is a subscriber crash only, so C:N/I:N/A:H with unchanged scope.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:31 vuln.today

Severity Changed

Jul 23, 2026 - 21:23 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 21:23 NVD

6.5 (MEDIUM) 7.1 (HIGH)

CVE Published

Jul 23, 2026 - 20:50 cve.org

HIGH 7.1

DescriptionCVE.org

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

AnalysisAI

Denial of service in MZ Automation's libiec61850 lets a network-adjacent attacker crash any application subscribing to GOOSE traffic by transmitting a single crafted L2 GOOSE or R-GOOSE frame carrying a malformed TLV. Because the fault lives in the shared parser used by both the Layer-2 and routable variants, both transport modes are affected, and successful exploitation produces a NULL pointer dereference that terminates the subscriber process. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with availability-only impact.

Technical ContextAI

libiec61850 is a widely used open-source implementation of the IEC 61850 protocol suite for electrical substation automation, providing GOOSE (Generic Object Oriented Substation Event) publish/subscribe messaging used to distribute time-critical protection and control signals between intelligent electronic devices (IEDs). GOOSE frames encode their payload using ASN.1 BER-style TLV (Type-Length-Value) structures; the CPE cpe:2.3:a:mz_automation:libiec61850 confirms the affected component is the library itself. The root cause is classified as CWE-228 (Improper Handling of Syntactically Invalid Structure): the shared parser servicing both Layer-2 GOOSE and routable R-GOOSE fails to validate a malformed TLV value before dereferencing a resulting pointer, leading to a NULL pointer dereference. This is a memory-safety/input-validation defect in the parsing path rather than a logic or authentication flaw.

RemediationAI

Consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 and MZ Automation's release notes for the fixed libiec61850 version, then upgrade the library (and rebuild/patch any downstream products that embed it) to that release - no vendor-released patch version was included in the provided data, so the exact fixed version could not be independently confirmed here. Until patched, apply network-layer compensating controls: because GOOSE is Layer-2 multicast, segment protection/automation traffic onto a dedicated VLAN and enforce strict access control so only trusted publishers reach subscribers, blocking untrusted hosts from the GOOSE segment; for R-GOOSE, filter the routable GOOSE traffic at Layer-3 boundaries and restrict it to known peers. The trade-off is operational: overly aggressive filtering or VLAN changes can break legitimate GOOSE subscription and delay protection signaling, so validate in a maintenance window. Enabling GOOSE integrity/authentication (per IEC 62351) where supported raises the bar for injecting crafted frames but does not itself fix the parser defect.