{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/open62541/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-116014"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-116014\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["open62541 (\u003c 1.5.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["open62541"],"content_html":"\u003cp\u003eThe open62541 library contains an integer overflow vulnerability in the UA_DataType_fromStructureDescription() function. The vulnerability occurs when processing 16-bit memSize fields within custom structure definitions. A malicious OPC UA server can deliver crafted DataType definitions via the UA_Client_getRemoteDataTypes() function, resulting in an overflow during calls to decodeBinaryStructure(). Successful exploitation causes heap corruption, which may lead to application crashes or remote code execution. This affects open62541 versions 1.5.0 through 1.5.6.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in heap corruption, causing service disruption via application crashes or potential remote code execution on the client-side system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the open62541 library to version 1.5.7 or later to address the integer overflow vulnerability in structure description parsing. Organizations utilizing libraries built on open62541 should identify internal applications using the library and schedule updates for the identified software.\u003c/p\u003e\n","date_modified":"2026-10-24T15:14:58Z","date_published":"2026-10-24T14:16:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-open62541-integer-overflow/","summary":"An integer overflow in the open62541 library allows a malicious OPC UA server to trigger heap corruption in clients, potentially leading to remote code execution.","title":"open62541: Integer overflow in UA_DataType_fromStructureDescription (CVE-2026-116014)","url":"https://feed.craftedsignal.io/briefs/2026-10-open62541-integer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Open62541","version":"https://jsonfeed.org/version/1.1"}