open62541 CVE-2026-18785

Exploitation requires that: (1) the target host compiles and runs a binary derived from examples/custom_datatype/client_types_custom.c - this is non-default example code, not a standard library component; (2) the attacker has local user access to the host (AV:L, PR:L from the CVSS 4.0 vector - remote unauthenticated exploitation is not possible); and (3) the client binary is executed against either an attacker-controlled OPC UA server endpoint or one that returns a crafted response. Factors limiting exploitation include: the code is in the examples directory and unlikely to appear in production deployments; local access is required, ruling out network-based attacks; and the scope is unchanged (S:U in equivalent 3.1 terms), meaning successful exploitation does not propagate to other systems. The project's closure of the issue without a fix suggests they consider this code out of scope for security guarantees.

Real-world risk is substantially lower than a surface-level CWE-416 assessment would suggest, for several compounding reasons. The CVSS 4.0 base score of 1.9 reflects local attack vector (AV:L) with low privileges (PR:L), meaning an attacker must already have local host access - this eliminates remote, unauthenticated attack scenarios entirely. More critically, the vulnerable code is in the examples directory, not the core library; production deployments that do not compile and ship example binaries are likely unaffected. The CVSS 4.0 E:P modifier confirms a POC exists but does not imply active exploitation. CISA KEV status is absent, further indicating no confirmed real-world weaponization. EPSS data was not provided in the input - this is a missing signal that would help contextualize exploitation probability. The project's decision to close the issue without remediation is notable: it implies the maintainers do not consider the example code production-grade, but it also means no official patch exists. Combined, this is a low-priority finding for most production deployments unless the example binaries are explicitly used in a deployed product.

A local user with standard (non-root) credentials on a host running a binary compiled from the open62541 example code executes the custom datatype client against a crafted or attacker-controlled OPC UA server endpoint. The server response triggers the use-after-free in UA_Client_getRemoteDataTypes, causing heap memory corruption. Depending on heap layout, this results in an application crash (denial of service) or, under favorable memory conditions, limited code execution within the process context. A publicly available proof-of-concept exists at https://github.com/gff-cw/information/issues/12.