Read the docs
TI-2026-80083 Aliases CVE-2026-116014GHSA-78c3-xxg6-2pf3

Integer overflow in open62541 custom DataType parsing

Priority MEDIUM 42CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

open62541 from 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions (CWE-190). A malicious OPC UA server can supply DataType definitions to clients, causing a heap buffer overflow that crashes clients or may enable code execution. A remote attacker who controls a server needs no privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed open62541 (open62541): 1.5.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open62541open625411.5.0 to before 1.5.71.5.7Patch availableCNA
  • open62541 Vendoropen62541 Affected 1.5.0 to before 1.5.7 Fixed in 1.5.7 Patch available CNA

Remediation

Update open62541 to version 1.5.7, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA open62541 (open62541) Fixed in 1.5.7

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-24 Threatist record created from CVE-2026-116014
  2. 2026-10-24 Alias added: GHSA-78c3-xxg6-2pf3
  3. 2026-10-29 CISA SSVC decision points changed
  4. 2026-11-03 Affected versions changed · Red Hat
  5. 2026-11-03 CVSS score added · Red Hat

References

Patch 3

Other 2

  • TI-2022-09335 Denial of service (DoS) in open62541/open62541 CVSS 3.1HIGH 7.5
  • TI-2020-18677 Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth. CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences