CVE-2026-116014
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
open62541 open62541
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.5.7open62541CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 3
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stemshop.bsky.social: 🚨 CVE-2026-116014 — CVSS 9.2 CRITICAL open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wr... 🔎 https://stemshop.top/cve/CVE-Bluesky: CVE posts, 24 Oct 2026
- @thehackerwire.bsky.social: 🟠 CVE-2026-116014 - High (8.1) open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription... https://www.thehackerwire.com/vulnerability/CVE-Bluesky: CVE posts, 24 Oct 2026
- @stackflag.bsky.social: CVE-2026-116014 - open62541 Versions of the open62541 library from 1.5.0 up to 1.5.6 can mishandle large custom data type definitions sent by an OPC UA server. This mistake can cauBluesky: CVE posts, 24 Oct 2026
Description
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
Text from CVE List
Affected versions 1
- open62541affected: 1.5.0 before 1.5.7CVE List
References 6
- github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ecFixvia CVE List
- github.com/open62541/open62541/pull/8298Fixvia CVE List
- github.com/open62541/open62541/pull/8302Fixvia CVE List
- github.com/open62541/open62541/releases/tag/v1.5.7Fixvia CVE List
- vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatypeAdvisoryvia CVE List
- github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274Referencevia CVE List