Open62541 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/open62541/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 14:16:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgopen62541: Integer overflow in UA_DataType_fromStructureDescription (CVE-2026-116014)https://feed.craftedsignal.io/briefs/2026-10-open62541-integer-overflow/Sat, 24 Oct 2026 14:16:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-open62541-integer-overflow/An integer overflow in the open62541 library allows a malicious OPC UA server to trigger heap corruption in clients, potentially leading to remote code execution.The open62541 library contains an integer overflow vulnerability in the UA_DataType_fromStructureDescription() function. The vulnerability occurs when processing 16-bit memSize fields within custom structure definitions. A malicious OPC UA server can deliver crafted DataType definitions via the UA_Client_getRemoteDataTypes() function, resulting in an overflow during calls to decodeBinaryStructure(). Successful exploitation causes heap corruption, which may lead to application crashes or remote code execution. This affects open62541 versions 1.5.0 through 1.5.6.

Impact

Successful exploitation may result in heap corruption, causing service disruption via application crashes or potential remote code execution on the client-side system.

Recommendation

Update the open62541 library to version 1.5.7 or later to address the integer overflow vulnerability in structure description parsing. Organizations utilizing libraries built on open62541 should identify internal applications using the library and schedule updates for the identified software.

]]>highadvisory