PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50103 MZ Automation CVE debrief

A NULL pointer dereference vulnerability exists in the L2 GOOSE and R-GOOSE shared parser of MZ Automation libIEC61850. This issue may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. Organizations should prioritize updating to the latest build to mitigate this vulnerability. Evidence from official records indicates that defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. The CVE record and CISA CSAF advisory provide details on the vulnerability, but additional verification is recommended to ensure the accuracy of the information.

Vendor
MZ Automation
Product
libIEC61850
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-23
Original CVE updated
2026-07-23
Advisory published
2026-07-23
Advisory updated
2026-07-23

Who should care

Organizations using MZ Automation libIEC61850 in their industrial control systems should prioritize updating to the latest build to mitigate this vulnerability. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their industrial control systems.

Technical summary

The vulnerability exists in the L2 GOOSE and R-GOOSE shared parser of MZ Automation libIEC61850. A network-adjacent attacker may exploit this issue by sending a crafted GOOSE frame containing a malformed TLV value, potentially causing a subscribing application to crash. This issue has a CVSS score of 6.5 and a severity of MEDIUM. Organizations should prioritize updating to the latest build to mitigate this vulnerability.

Defensive priority

Medium priority given the potential for denial of service and the availability of a vendor fix.

Recommended defensive actions

  • Update to the latest build of libIEC61850 as recommended by MZ Automation
  • Implement network segmentation to limit the attack surface
  • Monitor for suspicious network activity
  • Review and update incident response plans
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and CISA CSAF advisory provide details on the vulnerability. Evidence is based on official records from CVE.org and NVD. The vulnerability exists in the L2 GOOSE and R-GOOSE shared parser of MZ Automation libIEC61850, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50103 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50103

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50103 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50103

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-204-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.