EUVD-2026-52789
GHSA-r2hr-h3px-675c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges align with AV:L/PR:L; all impacts are bounded to low given no scope change and limited heap corruption reach.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
AnalysisAI
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory via the UA_Client_readNodeClassAttribute function in the client high-level API. The vulnerability is confined to local exploitation (AV:L/PR:L), limiting its network attack surface, but publicly available exploit code lowers the barrier for abuse on compromised or multi-tenant systems running open62541 OPC UA clients. The open62541 project closed the issue report as filed through unofficial channels, leaving patch status and official acknowledgment unconfirmed.
Technical ContextAI
open62541 is a widely-adopted open-source C implementation of the OPC UA (OPC Unified Architecture) communication standard, commonly embedded in industrial automation devices, PLCs, SCADA gateways, and IoT edge systems (CPE: cpe:2.3:a:o6:open62541:*:*:*:*:*:*:*:*). The affected function UA_Client_readNodeClassAttribute resides in src/client/ua_client_highlevel.c, which provides a high-level client API for reading node attributes from an OPC UA server. CWE-122 (Heap-based Buffer Overflow) indicates the root cause is a write beyond allocated heap buffer bounds during attribute reading, likely arising from insufficient validation of server-returned data lengths or node class attribute payloads before copying into a fixed-size heap allocation. This class of flaw can corrupt adjacent heap metadata or objects, potentially enabling limited memory disclosure or controlled memory writes.
RemediationAI
No vendor-released patch has been identified at time of analysis; the open62541 project closed the GitHub issue (https://github.com/open62541/open62541/issues/8139) citing improper reporting channels, and no official advisory has been published. Operators should monitor the official open62541 repository for a future patched release and apply it when available. As a compensating control, restrict local shell and user access to systems running open62541 client software, since exploitation requires local low-privileged access - reducing the attack surface to only essential personnel. In industrial environments, enforce least-privilege OS accounts for processes running OPC UA clients and audit user access logs. Avoid exposing systems running open62541 clients to untrusted local users. Note that these controls address the access prerequisite but do not eliminate the underlying heap overflow; code-level patching remains the definitive fix.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's His
Remote memory exhaustion in open62541's FindServers Discovery Service lets an unauthenticated attacker crash or degrade
Uncontrolled memory consumption in open62541's OPC UA Discovery Service allows a remote, unauthenticated attacker to cra
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) du
Use-after-free memory corruption in open62541's example client code allows a local low-privileged user to cause memory c
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a c
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today