CVE-2026-116014: open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
open62541 1.5.0 before 1.5.7 contains an integer overflow in UADataTypefromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UAClientgetRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
open62541to a version that resolves this vulnerability.Fixed in 1.5.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using open62541 versions from 1.5.0 through before 1.5.7 are exposed when they obtain remote DataType definitions from an OPC UA server through UA_Client_getRemoteDataTypes(). A malicious server can provide a large custom structure definition that triggers the vulnerable processing.
What does an attacker need to exploit it?
An attacker needs to operate or control an OPC UA server that the affected client connects to, and have that client retrieve remote DataType definitions. No client-side privileges or user interaction are required.
What is the practical impact on an affected client?
The integer overflow can cause decodeBinaryStructure() to overflow the heap. This can crash the client or potentially allow code execution.
How can I determine whether I am affected?
Check whether the application uses open62541 1.5.0 through before 1.5.7 and calls UA_Client_getRemoteDataTypes() against OPC UA servers that may be untrusted or attacker-controlled. The issue is triggered by large custom structure definitions supplied by the server.
What should be done if remediation cannot be applied immediately?
Avoid retrieving remote DataType definitions from untrusted OPC UA servers, particularly through UA_Client_getRemoteDataTypes(). Restrict client connections to trusted servers until an update is applied.