The vulnerability in libiec61850's GOOSE parser involves an off-by-one error in boundary handling. When processing specific GOOSE message fields, the internal buffer position is advanced incorrectly, leading to a heap out-of-bounds read. This flaw can be triggered remotely without authentication via a Layer-2 multicast frame on the process bus. The impact is a reliable denial-of-service condition due to termination of the subscriber process. There is no known patch or vendor remediation advisory at this time.

The vulnerability causes a denial-of-service (DoS) by crashing the subscriber process on affected platforms. There is no confidentiality or integrity impact reported. The DoS can be triggered remotely without authentication via a specially crafted multicast frame.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider network-level controls to restrict unauthenticated Layer-2 multicast traffic on the process bus to trusted sources only.