CVE-2026-66720: Mz Automation GmbH LIBIEC61850

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash and resulting in a denial-of-service condition.

Affected products

• Mz Automation GmbH LIBIEC61850: before 1.6.2 (fixed in 1.6.2)

Published 2026-07-30. Last modified 2026-09-03.