CVE-2026-116014 in open62541
Summary
by MITRE • 10/24/2026
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The open62541 library, a widely adopted open-source implementation of the IEC 62541 OPC Unified Architecture (OPC UA) protocol specification, contains a critical integer overflow vulnerability in versions prior to 1.5.7. This flaw resides specifically within the UA_DataType_fromStructureDescription function, which is responsible for parsing and processing DataType definitions provided by remote servers during client initialization or discovery phases. The core technical issue involves the handling of the memSize field, which is defined as a sixteen-bit unsigned integer. When an attacker supplies a maliciously crafted OPC UA server that includes custom structure definitions with excessively large size values, the arithmetic operations performed to calculate memory allocation requirements can exceed the maximum value representable by a 16-bit integer. This results in an integer wraparound, where the calculated size becomes significantly smaller than the actual required buffer space due to modulo arithmetic behavior inherent in fixed-width integer types.
This miscalculation directly impacts the subsequent decoding process within decodeBinaryStructure(). Because the system believes it only needs to allocate a small amount of memory based on the wrapped value, it proceeds with an undersized heap allocation. When the decoder subsequently attempts to populate this buffer with data from the malicious structure definition, it writes beyond the allocated boundaries. This constitutes a classic out-of-bounds write vulnerability that leads to heap corruption. The immediate operational impact is often a denial of service, manifested as a crash or segmentation fault in the OPC UA client application due to memory access violations triggered by the corrupted heap metadata or data structures. However, given the nature of heap-based buffer overflows, this flaw also presents a severe risk for arbitrary code execution if an attacker can carefully control the contents written into the overflowed region and manipulate adjacent heap chunks to achieve controlled memory writes.
From a threat modeling perspective, this vulnerability aligns with CWE-190, which describes integer overflow or wraparound leading to security weaknesses. The attack vector is classified under network-based exploitation where the initial interaction occurs over standard OPC UA communication channels. In terms of adversarial tactics, this flaw facilitates techniques associated with MITRE ATT&CK ID T1203, specifically Exploitation for Client Execution, as it targets client-side applications rather than server infrastructure directly. The vulnerability highlights a critical gap in input validation and bounds checking when processing untrusted external data structures that dictate memory layout parameters.
Mitigation strategies must prioritize immediate software updates to version 1.5.7 or later of the open62541 library, where developers have implemented proper checks to ensure that size calculations do not overflow and that allocated buffers are sufficient for the described structure sizes. For environments unable to patch immediately, network-level controls should be employed to restrict OPC UA connections to only trusted servers with known-good DataType definitions. Additionally, implementing strict input validation on client applications before passing remote data types into internal parsing functions can provide a layer of defense in depth. Security teams should also monitor for anomalous memory usage patterns or crashes in OPC UA clients that may indicate exploitation attempts against this specific integer overflow flaw.