CVE WatchJul 30, 2026

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing app

CVSS

6.5

Medium

EPSS

0.3%

p19

KEV

—

Exploit Today

0-100

Published: Jul 23, 2026 · Last modified: Jul 30, 2026 · CWE-228

EPSS · 30d

0.2%EPSS · 30 days0.3%

2026-08-142026-09-10

Technical description

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

Official references

www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-87986—

—

———An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval.11h