open62541 CVE-2026-18784

Local system access with at minimum a low-privileged OS account is required - remote unauthenticated exploitation is not possible given AV:L/PR:L in the CVSS 4.0 vector. The vulnerability is triggered through the UA_Client_readNodeClassAttribute function in the open62541 client high-level API, meaning the vulnerable code path is only exercised when an application calls this function to read node class attributes from an OPC UA server. If the client connects to a legitimate trusted server and no local attacker can influence the response or invoke the function independently, exploitation is further constrained. Limiting factors include: requirement for local interactive or programmatic access, low-privilege OS account at minimum, and dependency on the application actually invoking the affected high-level API function.

The CVSS 4.0 score of 1.9 reflects the combination of local-only attack vector (AV:L), low privileges required (PR:L), and uniformly low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). No scope change affects subsequent systems (SC:N/SI:N/SA:N), which is consistent with a client-side library vulnerability that does not propagate to the OPC UA server or other network hosts. The E:P supplemental metric confirms POC existence but does not elevate the base score meaningfully. CVE is not listed in CISA KEV, and EPSS data is not provided - given the local-only constraint and low impact ratings, widespread opportunistic exploitation is unlikely. The primary realistic risk is insider threat or post-compromise lateral movement on multi-user industrial workstations or embedded Linux devices running open62541 client software. The project's dismissal of the report through unofficial channels introduces uncertainty about whether a vendor-sanctioned fix will be released; this governance gap may leave the library unpatched for an extended period.

An attacker with a low-privileged local account on an industrial workstation or embedded device running an open62541 OPC UA client invokes or manipulates the UA_Client_readNodeClassAttribute function - either directly if they have code execution, or by crafting a malicious OPC UA server response if the client connects to an attacker-controlled endpoint - triggering the heap buffer overflow. Public exploit code exists (referenced at https://github.com/gff-cw/information/issues/11), which lowers the skill threshold for an insider or a post-compromise attacker seeking to escalate access or read adjacent heap memory.