open62541: Integer overflow in UA_DataType_fromStructureDescription (CVE-2026-116014)
An integer overflow in the open62541 library allows a malicious OPC UA server to trigger heap corruption in clients, potentially leading to remote code execution.
CVE search metadata
CVE search record: CVE-2026-116014. Severity: high. CVSS: 8.1. KEV: no. Product: open62541 (< 1.5.7). Brief: open62541: Integer overflow in UA_DataType_fromStructureDescription (CVE-2026-116014). Brief link: https://feed.craftedsignal.io/briefs/2026-10-open62541-integer-overflow/
Triage facts
Revision 2- Applicability
- open62541 (< 1.5.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 24, 15:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: has_poc, lastmod, poc_references, references, updates
Sources: 1
The open62541 library contains an integer overflow vulnerability in the UA_DataType_fromStructureDescription() function. The vulnerability occurs when processing 16-bit memSize fields within custom structure definitions. A malicious OPC UA server can deliver crafted DataType definitions via the UA_Client_getRemoteDataTypes() function, resulting in an overflow during calls to decodeBinaryStructure(). Successful exploitation causes heap corruption, which may lead to application crashes or remote code execution. This affects open62541 versions 1.5.0 through 1.5.6.
Impact
Successful exploitation may result in heap corruption, causing service disruption via application crashes or potential remote code execution on the client-side system.
Recommendation
Update the open62541 library to version 1.5.7 or later to address the integer overflow vulnerability in structure description parsing. Organizations utilizing libraries built on open62541 should identify internal applications using the library and schedule updates for the identified software.
Immediate actions
Patch open62541 library to version 1.5.7 or higher across all affected applications.
Threat Hunt
Identify applications utilizing the open62541 library that perform external OPC UA client connections.
Data: Software Bill of Materials (SBOM), Dependency manifests
Mitigations
Upgrade open62541 to version 1.5.7 or later.
CVE-2026-116014