Vulnerability details

CVE-2026-116014

open62541 open62541

open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType

CVSS 4.0

9.2Critical

Official description

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
open62541	open62541	1.5.0 ≤ v < 1.5.7	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec patch
https://github.com/open62541/open62541/pull/8298 patchissue-tracking
https://github.com/open62541/open62541/pull/8302 patchissue-tracking
https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274 technical-description
https://github.com/open62541/open62541/releases/tag/v1.5.7 release-notes
https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-24
Last updated: 2026-10-29
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 23 · Low

Exploit prediction (EPSS)

0.43%

Probability of exploitation in 30 days

37.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-190
Integer Overflow or Wraparound