CVE-2026-65423 in open62541
Summary
by MITRE • 07/31/2026
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability described represents a critical integer overflow condition within the open62541 OPC UA stack implementation that can be exploited by remote attackers to execute out-of-bounds write operations. This flaw exists specifically in the UA_Variant arrayDimensions product computation logic where the software fails to properly validate or constrain integer calculations when determining array dimensions for variant data types. The issue stems from inadequate input sanitization and overflow protection mechanisms that allow maliciously crafted numeric values to produce unexpected results during arithmetic operations.
The technical implementation of this vulnerability manifests when the open62541 library processes UA_Variant structures containing array dimension specifications. During computation of the total product of array dimensions, the software performs multiplication operations without proper overflow detection or boundary checking. When attackers provide carefully crafted dimension values that, when multiplied together, exceed the maximum representable value for the target integer type, the arithmetic operation wraps around to produce a much smaller value than expected. This overflow condition creates a scenario where the calculated buffer size becomes insufficient for the actual data being processed.
From an operational perspective this vulnerability poses significant risks to industrial control systems and IoT deployments that rely on open62541 for OPC UA communication. The out-of-bounds write condition can potentially be leveraged to corrupt memory regions, overwrite critical program variables, or even enable arbitrary code execution depending on the system architecture and memory layout. Attackers could exploit this through malformed OPC UA messages containing malicious array dimension specifications in variable value updates, node attribute reads, or any operation involving UA_Variant data structures. The remote nature of the attack means that systems exposed to untrusted networks or applications can be compromised without requiring local access.
This vulnerability aligns with CWE-190, Integer Overflow or Wraparound, and represents a classic example of how improper integer handling can lead to serious memory corruption issues. The ATT&CK framework categorizes this as a memory corruption technique that could enable privilege escalation or remote code execution depending on the target system's security posture. Organizations using open62541 in production environments should immediately implement mitigations including input validation, integer overflow checking, and proper bounds verification for all array dimension calculations. The most effective remediation involves patching to version 1.3.4 or later where the integer overflow protection has been implemented, along with deploying network segmentation and access controls to limit exposure of affected systems to untrusted networks.
The broader implications extend beyond immediate exploitation potential to highlight fundamental security considerations in industrial communication protocols. This vulnerability demonstrates how seemingly benign data processing operations can become attack vectors when proper input validation and arithmetic safety measures are absent from critical system components. Organizations should conduct comprehensive audits of their OPC UA implementations and ensure that all third-party libraries receive timely security updates, particularly those handling variable-length data structures and array computations in industrial automation environments where reliability and security are paramount requirements.