Threat database

An integer overflow vulnerability exists in open62541 versions 1.5.0 through 1.5.6 in the UA_DataType_fromStructureDescription() function. This overflow affects the 16-bit memSize field for large custom structure definitions, allowing a malicious OPC UA server to cause a heap overflow in clients via crafted DataType definitions. Exploitation can lead to client crashes or potentially remote code execution. The issue is fixed in version 1.5.7.

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.

A buffer overflow vulnerability exists in open62541 version 1.5.5. This flaw occurs in the Service_Call function, which validates input arguments against runtime-resolved InputArguments metadata. An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service (DoS) condition. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance is currently available.

A denial of service vulnerability exists in open62541 versions 1.5.5 and earlier. The issue arises from the NodeManagement type-instantiation logic, allowing a remote attacker to cause service disruption without requiring authentication. The vulnerability has a high severity rating with a CVSS score of 7.5.

open62541 version 1.5.5 contains a heap-based buffer overflow vulnerability in the default HistoryRead path when using the default history database with the memory backend. This vulnerability can lead to a denial of service due to application crash. The issue is identified as CWE-122 and has a CVSS 3.1 base score of 7.5, indicating high severity. There is no vendor advisory or patch information currently available.

An out-of-bounds read vulnerability exists in open62541 version 1.5.5 within the client-side function responseReadNamespacesArray() located in src/client/ua_client_connect.c. This flaw can lead to unauthorized memory access when processing namespace array responses.

A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

A buffer overflow vulnerability exists in open62541 version 1.5.5 that allows a remote attacker to cause a denial of service via the Discovery/LDS handling functionality. This vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation has been confirmed at this time.

A denial of service vulnerability exists in open62541 version 1.5.5 and earlier. The flaw is triggered via the UA_Client_getRemoteDataTypes component, allowing a remote attacker to cause a denial of service without requiring user interaction or privileges.

A denial of service vulnerability exists in open62541 version 1.5.5 and earlier. Remote attackers can exploit this issue by sending specially crafted OPC UA service requests such as CreateSubscription, CreateMonitoredItems (Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions. This leads to resource exhaustion or application disruption without requiring authentication.

CVE-2026-63362 is an unsigned integer underflow vulnerability in the PubSub signature verification path of the open62541 library by o6 Automation. This flaw may allow a remote attacker to cause a denial of service by sending a crafted UDP packet. The vulnerability affects versions 1.3.0, 1.4.0, and 1.5.0 of open62541. The severity is rated medium with a CVSS score of 5.9. No official patch or remediation guidance is currently available.

CVE-2026-63035 is a heap use-after-free vulnerability in the TransferSubscriptions service of the open62541 product by o6 Automation. It may allow an authenticated attacker to cause denial of service or potentially execute arbitrary code. The vulnerability affects versions 1.3.0, 1.4.0, and 1.5.0. The CVSS score is 8.1, indicating high severity. No official patch or remediation guidance is currently available.

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information.

A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argument Server_NamespaceArray leads to null pointer dereference. The attack can be executed remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit is publicly available and might be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.