MZ Automation libiec61850: GOOSE message replay state rollback (CVE-2026-52134)
The libiec61850 library v1.6 fails to sufficiently reject replayed or outdated GOOSE messages, which can cause subscribers to update state or trigger callbacks with stale data.
CVE search metadata
CVE search record: CVE-2026-52134. Severity: critical. CVSS: 9.8. EPSS: 0.80%. KEV: no. Product: libiec61850 (1.6). Brief: MZ Automation libiec61850: GOOSE message replay state rollback (CVE-2026-52134). Brief link: https://feed.craftedsignal.io/briefs/2026-10-libiec61850-goose-replay/
Triage facts
Revision 1- Applicability
- libiec61850 (1.6)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 27, 01:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-52134 affects the parseGoosePayload() function in src/goose/goose_receiver.c of libiec61850 v1.6. Controlled experiments demonstrated that replaying captured GOOSE frames can trigger state rollbacks (where a subscriber reverts to a lower stNum) or cause the library to trigger listener callbacks for messages marked as invalid.
Prerequisites
To conduct the described replay behavior, an actor must be able to access the relevant IEEE 802.3 Layer 2 broadcast domain or VLAN, capture legitimate GOOSE Ethernet frames (EtherType 0x88B8), and inject frames into the network.