{"id":"CVE-2026-116014","kind":"vulnerability","aliases":["CVE-2026-116014"],"related":[],"title":"open62541: integer overflow in OPC UA client datatype parsing enables heap overflow","description":"open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.","summary":"open62541 1.5.0 before 1.5.7 wraps a 16-bit memory size field when it parses large custom structure definitions from a server. A malicious OPC UA server can use this to overflow the heap in a connecting client, crashing it or possibly running code.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","embedded","industrial-control","infrastructure","opc-ua","open62541"],"not_affected_if":["no-remote-datatype-fetch","trusted-servers-only","version-1.5.7-or-later"],"how_to_check":"- Check the open62541 version the client application is built or linked against, e.g. `1.5.0` through `1.5.6` are affected\n- Look for calls to `UA_Client_getRemoteDataTypes()` in the client code, since that is the path that reaches the flaw","fix":"- Upgrade open62541 to `1.5.7` or later\n- Until upgraded, avoid calling `UA_Client_getRemoteDataTypes()` against servers you do not fully trust","status":"open","published_at":"2026-10-24T12:16:57+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","triaged_at":"2026-10-25T02:59:49+00:00","updated_at":"2026-10-25T02:59:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T02:59:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade open62541 to `1.5.7` or later\n- Until upgraded, avoid calling `UA_Client_getRemoteDataTypes()` against servers you do not fully trust","reach":"network","title":"open62541: integer overflow in OPC UA client datatype parsing enables heap overflow","impact":"high","summary":"open62541 1.5.0 before 1.5.7 wraps a 16-bit memory size field when it parses large custom structure definitions from a server. A malicious OPC UA server can use this to overflow the heap in a connecting client, crashing it or possibly running code.","category":"infrastructure","nicknames":[],"who_cares":["open62541","opc-ua","industrial-control","c","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"malicious server crashes client or runs code on it","analyst_note":"Confirm the exploitability of the heap overflow and whether code execution is realistic; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116014 is the only source and gives no fix-version detail beyond 1.5.7.","how_to_check":"- Check the open62541 version the client application is built or linked against, e.g. `1.5.0` through `1.5.6` are affected\n- Look for calls to `UA_Client_getRemoteDataTypes()` in the client code, since that is the path that reaches the flaw","needs_analyst":true,"not_affected_if":["version-1.5.7-or-later","no-remote-datatype-fetch","trusted-servers-only"],"who_is_affected":"OPC UA client applications built on open62541 1.5.0 up to but not including 1.5.7 that fetch remote custom DataType definitions from servers. The attacker has to be an OPC UA server the client connects to, so industrial or integration clients that talk to third-party or untrusted servers are the main concern. Clients that only talk to fixed, trusted servers or do not call the remote datatype function are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000694,"input_tokens":3368,"output_tokens":714,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116014':15A,18A '-2026':14A,17A '1.5.0':30B,73C '1.5.7':32B,75C '16':35B,87C 'bit':36B,88C 'c':19B 'caus':109C 'client':7A,65B,107C,116C 'code':71B,119C 'connect':64B 'contain':76C 'control':23B 'crash':66B,115C 'custom':44B,93C 'cve':13A,16A 'datatyp':8A,82C,103C 'decodebinarystructur':110C 'definit':46B,95C,104C 'embed':20B 'enabl':10A,118C 'execut':120C 'field':39B,90C 'fromstructuredescript':83C 'getremotedatatyp':108C 'heap':11A,61B,114C 'industri':22B 'industrial-control':21B 'infrastructur':24B 'integ':2A,78C 'larg':43B,92C 'malici':51B,97C 'memori':37B 'memsiz':89C 'opc':5A,26B,52B,98C 'opc-ua':25B 'open62541':1A,28B,29B,72C 'overflow':3A,12A,59B,79C,112C 'pars':9A,42B 'possibl':69B 'run':70B 'server':49B,54B,100C 'size':38B 'structur':45B,94C 'suppli':102C 'ua':6A,27B,53B,81C,99C,106C 'use':56B 'via':105C 'wrap':33B,85C","nicknames":[],"mitigations":[],"who_affected":"OPC UA client applications built on open62541 1.5.0 up to but not including 1.5.7 that fetch remote custom DataType definitions from servers. The attacker has to be an OPC UA server the client connects to, so industrial or integration clients that talk to third-party or untrusted servers are the main concern. Clients that only talk to fixed, trusted servers or do not call the remote datatype function are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T12:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116014","severity":null,"published_at":"2026-10-24T12:16:57+00:00","modified_at":"2026-10-24T12:16:57+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","fetched_at":"2026-10-24T12:47:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}