EUVD-2026-43659
GHSA-cfxc-8gpx-qrvw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector for remote server-to-client trigger; AC:H for required server control or MITM; PR:L for rogue server operation; availability-only crash with no C or I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argument Server_NamespaceArray leads to null pointer dereference. The attack can be executed remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit is publicly available and might be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
AnalysisAI
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a connecting client by returning a malformed Server_NamespaceArray during session establishment, causing denial of service. The flaw is client-side only - server deployments are unaffected - and exploitation requires the attacker to control or impersonate a server the vulnerable client connects to, making practical exploitation high-complexity. A proof-of-concept exists as a GitHub issue report; no public exploit is confirmed as weaponized and the vulnerability is not listed in CISA KEV.
Technical ContextAI
open62541 is a widely-used open-source C implementation of the OPC UA (OPC Unified Architecture) communication protocol, commonly embedded in industrial control systems, SCADA environments, and IoT gateways. The vulnerable function responseReadNamespacesArray in src/client/ua_client_connect.c processes the Server_NamespaceArray field returned by an OPC UA server during the client connection handshake. CWE-476 (Null Pointer Dereference) indicates the function dereferences a pointer without first validating it against NULL - most likely when the server returns an unexpected or empty namespace array structure during session setup. The CPE string cpe:2.3:a:n/a:open62541:*:*:*:*:*:*:*:* covers all versions through 1.5.5. Because the flaw is in the Shared Client Library, any application embedding open62541 as a client is potentially affected when connecting to a hostile or malformed server.
RemediationAI
No vendor-released patch has been identified at time of analysis - the open62541 project closed issue #8104 without addressing it through an official security process, citing improper reporting channel. Organizations should monitor the project's official security disclosure path for a formal fix and track open62541 releases beyond 1.5.5 for an implicit fix. As compensating controls: restrict open62541 client connections exclusively to trusted, verified OPC UA servers using network-level allowlists or firewall rules to block connections to unauthorized endpoints; deploy OPC UA over TLS with mutual certificate authentication to prevent rogue server impersonation, noting this adds certificate management overhead; in ICS environments, process-isolate OPC UA client applications so a crash does not cascade to safety-critical or control-plane functions. Teams with in-house C expertise may manually patch the null pointer check in responseReadNamespacesArray by adding a NULL guard before the dereference and rebuilding from source at https://github.com/open62541/open62541/.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today