The vulnerability CVE-2026-66720 affects the libiec61850 library by MZ Automation GmbH. It arises from improper validation of the UTC timestamp field in IEC 61850 GOOSE messages. Specifically, the GOOSE subscriber component processes unauthenticated Layer-2 multicast messages (EtherType 0x88B8) and does not correctly check the size of the timestamp field. An attacker can send a malformed GOOSE frame with an undersized timestamp, triggering a heap out-of-bounds read during message processing. This results in a denial-of-service (DoS) condition by crashing the affected process. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation causes a denial-of-service condition by crashing the process handling the GOOSE messages. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires network access to send specially crafted multicast messages but does not require authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider restricting network access to the affected GOOSE multicast traffic or deploying network-level filtering to block malformed frames if feasible.