This vulnerability involves a use-after-free condition in the UA_Client_getRemoteDataTypes function of open62541, an open-source implementation of OPC UA. The flaw exists in the example client code handling custom data types, potentially leading to memory corruption when manipulated locally. The vulnerability has a CVSS 4.8 (medium) score, indicating limited impact and attack complexity. The project has not issued an official fix or advisory, and no patch links are available. Exploitation requires local access, and no known exploits are currently in the wild.

The vulnerability allows local attackers with low privileges to trigger a use-after-free condition, which may lead to memory corruption. The impact is limited due to the local attack vector and the absence of privilege escalation or remote exploitation capabilities. The medium severity score reflects these constraints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not officially acknowledged or patched this vulnerability, users should monitor official channels for updates. Until a fix is available, avoid running untrusted code locally that interacts with the affected function or example client code.