A crafted IEC 60870-5-104 I-frame with TypeID 104 (CTSNA1) and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer.

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer.

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.