Live › vulnerability › CVE-2026-116014
Go to dashboardopen62541 1.5.0 before 1.5.7 wraps a 16-bit memory size field when it parses large custom structure definitions from a server. A malicious OPC UA server can use this to overflow the heap in a connecting client, crashing it or possibly running code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
OPC UA client applications built on open62541 1.5.0 up to but not including 1.5.7 that fetch remote custom DataType definitions from servers. The attacker has to be an OPC UA server the client connects to, so industrial or integration clients that talk to third-party or untrusted servers are the main concern. Clients that only talk to fixed, trusted servers or do not call the remote datatype function are less exposed.
No product ranges from the sources yet.
1.5.0 through 1.5.6 are affectedUA_Client_getRemoteDataTypes() in the client code, since that is the path that reaches the flaw1.5.7 or laterUA_Client_getRemoteDataTypes() against servers you do not fully trustEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-116014")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.