open62541 CVE-2026-116014

Exploitation requires the victim to run an open62541-based OPC UA client (versions 1.5.0 through 1.5.6) that connects to an attacker-controlled or compromised OPC UA server AND actively invokes UA_Client_getRemoteDataTypes() to fetch custom DataType definitions. The malicious server must supply a crafted structure description whose field count exceeds UA_BYTE_MAX or whose cumulative member size exceeds UA_UINT16_MAX, wrapping the 16-bit memSize bitfield in UA_DataType_fromStructureDescription() and triggering the heap overflow in decodeBinaryStructure(). Limiting factors: the client must initiate the remote type request against an untrusted server (reflected by AT:P), so passively deployed clients or clients that never call getRemoteDataTypes or only connect to trusted servers are not exposed; no authentication on the client is required (PR:N).

CVSS 4.0 rates this 9.2 (Critical) with AV:N/AC:L/PR:N/UI:N and high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), and vuln.today assigns an 'act_now' priority, so urgency is high. However, the defining nuance is AT:P and the attack direction: this is a CLIENT-side flaw where the attacker is a malicious OPC UA server, not a remotely reachable service - real-world risk therefore hinges on whether open62541-based clients connect to untrusted servers and call UA_Client_getRemoteDataTypes(). No EPSS score is provided in the input, so probabilistic exploitation likelihood cannot be compared. There is no CISA KEV listing, so this is not confirmed as actively exploited, and no confirmed working exploit code is present (the references are patches, source links, and a VulnCheck advisory, not a verified PoC). The mechanism is well understood and a fix exists (1.5.7), and heap overflow with potential code execution plus the act_now label justify prompt patching; the primary mitigating factor against mass exploitation is that the victim must initiate a request to an attacker-controlled server rather than the server being passively exploitable.

An attacker operates or compromises an OPC UA server that a victim open62541 1.5.x client connects to. When the client calls UA_Client_getRemoteDataTypes() to resolve custom types, the malicious server returns an oversized DataType structure definition whose field count or cumulative size exceeds the 16-bit memSize bitfield; the resulting integer overflow desynchronizes the computed member layout and corrupts the heap in decodeBinaryStructure(), crashing the client or potentially achieving code execution. No confirmed public exploit code was identified at time of analysis.