CVE-2026-66720

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. An attacker can send a specially crafted GOOSE frame with an undersized timestamp field to trigger a heap out-of-bounds read during message processing. This leads to a process crash and a subsequent denial-of-service condition. A heap out-of-bounds read occurs when a program reads data past the end of the allocated memory buffer on the heap.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.