CVE-2026-66364

The GOOSE payload parser contains a boundary handling flaw that can be 
triggered by a single unauthenticated Layer 2 multicast frame on the 
process bus. When processing specific payload fields, an attacker 
controlled inner element length may exceed its enclosing length, causing
 the parser to over read by one byte. This out-of-bounds read reliably 
terminates the subscriber process, resulting in a denial-of-service 
condition.