An unsigned integer underflow exists in the PubSub signature verification path of the open62541 library, which is used for OPC UA communication. This vulnerability can be triggered remotely via a crafted UDP packet, leading to a denial of service condition. The affected versions explicitly include 1.3.0, 1.4.0, and 1.5.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No known exploits are reported in the wild, and no vendor remediation or patch has been published as of the data provided.

A remote attacker can cause a denial of service by exploiting an unsigned integer underflow in the PubSub signature verification path of open62541. This results in service disruption but does not affect confidentiality or integrity. The impact is limited to availability degradation or crash of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by restricting UDP traffic to trusted sources or disabling the vulnerable PubSub feature if feasible. Monitor vendor channels for updates and apply patches promptly once released.