open62541: Integer overflow in custom DataType handling leads to heap overflow
Summary
The open62541 OPC UA library from version 1.5.0 up to before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription(). Large custom structure definitions wrap the 16-bit memSize field, which can cause a heap overflow in decodeBinaryStructure(). A malicious or spoofed OPC UA server can trigger this when a client fetches DataType definitions via UA_Client_getRemoteDataTypes(), potentially crashing the client or enabling code execution.
Affected
- open62541 1.5.0 up to before 1.5.7 (CNA record)
- Versions before 1.5.0: Unknown.
Fixed in
- Upgrade to open62541 1.5.7 or later.
Workaround
- No vendor workaround documented.
- Until patched, connect only to trusted, authenticated OPC UA servers and disable retrieval of remote DataType definitions where it is not needed.
Exploitation
- No public proof of concept or confirmed in-the-wild exploitation known at time of writing.
- CISA SSVC: exploitation none, not automatable.
- Not listed in CISA KEV.
Our recommendation
- Inventory all OPC UA clients and devices or software that embed open62541.
- Upgrade open62541 to 1.5.7 or later, or obtain a fixed build from the product vendor.
- Restrict OPC UA client connections to trusted servers and monitor for unexpected server connections or client crashes.
- Check your distribution's security tracker for backports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory for open62541 1.5.0 before 1.5.7 www.vulncheck.com
- open62541 fix commit 0cf4806 github.com
- open62541 pull request 8298 github.com
- open62541 pull request 8302 github.com
- open62541 release v1.5.7 github.com
- Ubuntu security record CVE-2026-116014 ubuntu.com
- VulDB entry 426112 vuldb.com
- OpenCVE record CVE-2026-116014 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:03.
Original description (NVD)
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
NVD references (6)
- https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274
- https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec
- https://github.com/open62541/open62541/pull/8298
- https://github.com/open62541/open62541/pull/8302
- https://github.com/open62541/open62541/releases/tag/v1.5.7
- https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-c…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.