High 8.1Published Oct 24, 2026

CVE-2026-116014open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType

Updated under an hour ago (Oct 26, 2026, 2:00 PM ET)

Does this affect you?

It affects open62541. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for open62541

Exploited in the last 30 days

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Received
Record last updated: Oct 24, 2026
First seen by InfoSec Signals: Oct 24, 2026

Affected products

Affected products

open62541 open62541 open62541:open62541 (from the name)	from 1.5.0 before 1.5.7	CNA record

References

References

https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec	patch
https://github.com/open62541/open62541/pull/8298	patch, issue-tracking
https://github.com/open62541/open62541/pull/8302	patch, issue-tracking
https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274	technical-description
https://github.com/open62541/open62541/releases/tag/v1.5.7	release-notes
https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.