An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap… (CVE-2026-63559)

The vulnerability identified as CVE-2026-63559 involves an integer overflow in the calculation of the product of arrayDimensions within the UA_Variant structure in open62541. This overflow can cause out-of-bounds heap memory reads, which may disclose sensitive information to a remote attacker. The affected versions explicitly stated are =1.4.11.1-1build1, =1.4.18-1, and =1.4.11.1-1. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and has a high impact on confidentiality but no impact on integrity or availability.

A remote attacker can exploit this integer overflow to read out-of-bounds heap memory, potentially disclosing sensitive information. The vulnerability does not affect integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the input data. Users of affected versions should monitor vendor communications for updates and apply patches once available.