CVE-2026-50103 — Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

CVE-2026-50103

Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850 PUBLISHED

Description (CNA)

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

Affected (CNA)

Vendor / product	Versions
MZ Automation / libIEC61850	affected 1.0.0 through 1.6.1

CWE

CWE-228

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.