An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. This vulnerability is identified as CWE-190 and affects open62541 versions 1.3.0, 1.4.0, and 1.5.0. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only. There is no vendor-provided patch or official remediation level at this time.

Successful exploitation of this integer overflow vulnerability can lead to unauthorized disclosure of sensitive information by reading out-of-bounds heap memory remotely. The integrity and availability of the system are not impacted. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider risk mitigation strategies such as limiting network exposure of affected open62541 instances and monitoring for unusual activity related to UA_Variant arrayDimensions processing.