The vulnerability exists in the GOOSE subscriber component of libiec61850, where it fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE multicast messages (EtherType 0x88B8). This improper validation allows an attacker to send a malicious GOOSE frame with an undersized timestamp field, triggering a heap out-of-bounds read during message processing. The resulting crash causes a denial-of-service condition on the affected process. There is no indication of confidentiality or integrity impact, and no known exploits in the wild have been reported. No patch or official remediation has been disclosed at this time.

The vulnerability leads to a denial-of-service condition by crashing the affected process through a heap out-of-bounds read triggered by malformed GOOSE messages. There is no impact on confidentiality or integrity according to the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been disclosed. Until a patch is available, consider restricting or monitoring network access to IEC 61850 GOOSE multicast traffic to reduce exposure.