CVE-2026-116014
CVE-2026-116014 · open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
This page contains facts from public vulnerability sources. Check the original advisory before updating.
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
CVSS 9.2 · Critical · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec
- https://github.com/open62541/open62541/pull/8298
- https://github.com/open62541/open62541/pull/8302
- https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274
- https://github.com/open62541/open62541/releases/tag/v1.5.7
- https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype
- https://nvd.nist.gov/vuln/detail/CVE-2026-116014