open62541 CVE-2026-15690

Exploitation requires the attacker to control or credibly impersonate an OPC UA server that a vulnerable open62541 client (version 1.5.5 or earlier) actively connects to - achieved either by operating a rogue server on the same network segment or by executing a man-in-the-middle attack against OPC UA session establishment. The CVSS 4.0 vector confirms PR:L (low-privilege access) and AC:H (high complexity), meaning the attacker cannot passively exploit this from the internet but must have meaningful network positioning relative to the client. The vulnerability is triggered during the client-side connection handshake only: server-mode deployments of open62541 are not affected. Impact is limited to crashing the connecting client process - there is no code execution path and no server-side exploitation surface. Limiting factors include: high attack complexity (server control or MITM required), availability-only impact (crash, not RCE), and client-only exposure.

The CVSS 4.0 score of 1.3 is among the lowest possible, accurately reflecting a narrow, high-complexity denial-of-service condition. The vector AV:N/AC:H/PR:L confirms network reachability but demands the attacker either operate a rogue OPC UA server or execute a man-in-the-middle attack during client connection establishment - a non-trivial prerequisite. Impact is strictly limited to VA:L (low availability on the vulnerable system) with no confidentiality or integrity dimensions. No EPSS data was provided in the intelligence feed, and the CVE is not listed in CISA KEV, so no confirmed active exploitation signal exists. The publicly available POC (GitHub issue #8104) is a demonstration report rather than a weaponized exploit. In industrial or ICS contexts, even a low-severity client crash could carry operational significance if the affected client controls process data acquisition, but this is a contextual amplifier, not a base-score factor. Overall, this is a genuine but very low real-world priority except for organizations with direct exposure to untrusted OPC UA server infrastructure.

An attacker on the same network segment as an open62541-based client application deploys a rogue OPC UA server or performs a man-in-the-middle attack against an existing OPC UA endpoint. When the vulnerable client initiates a session and calls responseReadNamespacesArray during the handshake, the attacker's server returns a crafted or malformed Server_NamespaceArray payload that triggers a null pointer dereference, crashing the client process. A proof-of-concept demonstrating this behavior is publicly available via the GitHub issue at https://github.com/open62541/open62541/issues/8104.