Is CVE-2026-66720 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-66720?

CVE-2026-66720 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-66720

Description

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash and resulting in a denial-of-service condition.