libiec61850 Hit With Eight Heap Out-of-Bounds Reads in One Advisory

Eight heap out-of-bounds read vulnerabilities in a single IEC 61850 protocol library is not a normal advisory week. It's a pattern. And it's one that should make any engineer responsible for an OT substation gateway or IED integration sit up and take notice.

The library, the protocol, the blast radius

MZ Automation's libiec61850 is an open-source C library that implements the IEC 61850 standard for substation automation, GOOSE messaging (Layer-2 multicast, EtherType 0x88B8) for protection signaling and MMS (TCP port 102) for supervisory control. It's compiled into substation gateways, RTUs, IEDs, and SCADA front-end processors from multiple vendors worldwide. When CISA says "Countries/Areas Deployed: Worldwide" and "Critical Infrastructure Sectors: Energy," the understatement is deliberate. This library is in the process bus.

The eight CVEs all land in the same class: CWE-125, heap out-of-bounds read. The trigger mechanisms vary (off-by-one in GOOSE payload parsing (CVE-2026-66369), missing length validation on BER-encoded MMS fields (CVE-2026-65421), a zero-length attacker-controlled value in the ISO Presentation layer's normal-mode negotiation (CVE-2026-66360)) but the outcome is uniform. Process termination. Denial of service.

What makes this cluster worth a closer read

Three things. First, the attack surface spans the entire protocol stack: Layer-2 GOOSE multicast at the process-bus level, ACSE association establishment, ISO Presentation layer negotiation, and MMS confirmed-request BER decoding. That's not a single function with a bug. That's systematic under-validation across every parsing entry point.

Second, the GOOSE vulnerabilities (at least four of the eight) require no authentication and no session. A single crafted multicast frame on the process bus is enough. The CVSS vectors reflect this: AV:A (adjacent network) for several, but in a substation context "adjacent" means "on the same Ethernet segment as the protection relays." That segment is the one you can't afford to lose.

Third, this isn't libiec61850's first trip through the CISA advisory process. The 2022 advisory (ICSA-22-251-01) covered four vulnerabilities in versions ≤1.5, including two stack-based buffer overflows scored at CVSS 10.0. The library has a history of input-validation gaps in protocol parsing code, and this latest batch (all out-of-bounds reads rather than writes) narrows the impact to DoS but broadens the count. The remediation is the same each time: update to the latest release. This time that's 1.6.2.

What the practitioner does Monday

The vendor says update to 1.6.2. That's straightforward for software distributions. It's not straightforward for firmware. If libiec61850 is compiled into a substation gateway or IED from a third-party vendor, the responsible party is that vendor, and the patch timeline depends on their firmware release cycle. The advisory doesn't enumerate affected downstream products. The security engineer's Monday task is to identify every device in the environment that implements IEC 61850 GOOSE subscription or MMS client/server functionality, determine whether the stack includes libiec61850, and press the vendor for a firmware roadmap. For GOOSE-only devices on a physically segregated process bus, the adjacent-network requirement provides some containment. For anything bridging the process bus and station bus, or exposing MMS on TCP/102 to a routable network, the urgency is higher, CVE-2026-66360 triggers on connection attempt, pre-session, with CVSS 8.7.

The eight-CVE concentration in a single protocol-parsing library is the signal. The underlying input-validation gaps that produced it aren't unique to this library, they're endemic in OT protocol stacks that were written when the process bus was assumed to be physically isolated and trusted. That assumption hasn't been true for years, but the code hasn't caught up.