CVE-2026-116014
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
| CWE | CWE-190 |
| Vendor | open62541 |
| Product | open62541 |
| Published | Oct 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for open62541 open62541
Be the first to know when new high vulnerabilities affecting open62541 open62541 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
open62541 / open62541
1.5.0 < 1.5.7
References
github.com: https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec github.com: https://github.com/open62541/open62541/pull/8298 github.com: https://github.com/open62541/open62541/pull/8302 github.com: https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274 github.com: https://github.com/open62541/open62541/releases/tag/v1.5.7 vulncheck.com: https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype
Credits
BUG|PWN Research Sadoc ADONON