PatchSiren cyber security CVE debrief

CVE-2026-50103 MZ Automation CVE debrief

A NULL pointer dereference vulnerability exists in the L2 GOOSE and R-GOOSE shared parser of MZ Automation libIEC61850. This issue may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. Organizations should prioritize updating to the latest build to mitigate this vulnerability. Evidence from official records indicates that defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. The CVE record and CISA CSAF advisory provide details on the vulnerability, but additional verification is recommended to ensure the accuracy of the information.

Vendor: MZ Automation
Product: libIEC61850
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-23
Original CVE updated: 2026-07-23
Advisory published: 2026-07-23
Advisory updated: 2026-07-23

Who should care

Organizations using MZ Automation libIEC61850 in their industrial control systems should prioritize updating to the latest build to mitigate this vulnerability. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their industrial control systems.

Technical summary

The vulnerability exists in the L2 GOOSE and R-GOOSE shared parser of MZ Automation libIEC61850. A network-adjacent attacker may exploit this issue by sending a crafted GOOSE frame containing a malformed TLV value, potentially causing a subscribing application to crash. This issue has a CVSS score of 6.5 and a severity of MEDIUM. Organizations should prioritize updating to the latest build to mitigate this vulnerability.

Defensive priority

Medium priority given the potential for denial of service and the availability of a vendor fix.

Recommended defensive actions

Update to the latest build of libIEC61850 as recommended by MZ Automation
Implement network segmentation to limit the attack surface
Monitor for suspicious network activity
Review and update incident response plans
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review compensating controls for exposed systems while remediation is scheduled and verified
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and CISA CSAF advisory provide details on the vulnerability. Evidence is based on official records from CVE.org and NVD. The vulnerability exists in the L2 GOOSE and R-GOOSE shared parser of MZ Automation libIEC61850, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T06:00:00.000Z and has not been modified since then.