The vulnerability CVE-2026-66364 in libiec61850 arises from improper boundary handling in the GOOSE payload parser. Specifically, an attacker can craft a Layer 2 multicast frame with an inner element length that exceeds its enclosing length, causing the parser to read one byte out-of-bounds. This triggers a reliable termination of the subscriber process, leading to denial-of-service. The flaw does not require authentication and has no impact on confidentiality or integrity, only availability.

An unauthenticated attacker can cause a denial-of-service condition by sending a specially crafted Layer 2 multicast frame to the libiec61850 GOOSE payload parser. This results in the subscriber process terminating unexpectedly, disrupting service availability. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time.