EUVD-2026-52792
GHSA-vm49-7pv6-899p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requires low-privilege access to trigger use-after-free in example code; confidentiality and integrity impacts are limited to process memory.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
AnalysisAI
Use-after-free memory corruption in open62541's example client code allows a local low-privileged user to cause memory corruption with potential for denial of service or limited code execution. The vulnerability resides in the UA_Client_getRemoteDataTypes function within the examples/custom_datatype/client_types_custom.c file - notably example/sample code rather than the core library - at commit ca356b088ada7dee824d1b4acd07c1ff07ce242b. A publicly available proof-of-concept exploit exists, though the project closed the issue report citing improper disclosure channel, leaving no official patch or advisory. No confirmed active exploitation (CISA KEV absent), but the CVSS 4.0 E:P modifier reflects the published POC.
Technical ContextAI
open62541 is an open-source C implementation of OPC UA (OPC Unified Architecture), a machine-to-machine communication protocol widely used in industrial automation and ICS/OT environments. The affected code resides in examples/custom_datatype/client_types_custom.c - specifically in the UA_Client_getRemoteDataTypes function, which retrieves remote custom data type definitions from an OPC UA server. CWE-416 (Use After Free) indicates that a memory region is freed and subsequently accessed, yielding a dangling pointer. In C-based OPC UA implementations, data type lifetime management is complex, and incorrect deallocation ordering in client-side type negotiation can expose freed heap memory to subsequent reads or writes. The CPE cpe:2.3:a:o6:open62541:*:*:*:*:*:*:*:* covers all versions of the library, though the specific commit hash ca356b088ada7dee824d1b4acd07c1ff07ce242b narrows the confirmed vulnerable state.
RemediationAI
No vendor-released patch has been identified at time of analysis. The project closed the issue report (https://github.com/open62541/open62541/issues/8131) citing improper disclosure channel, and issued no official fix or advisory. The primary compensating control is to avoid compiling and deploying the examples/custom_datatype/client_types_custom.c example binary in any production or internet-adjacent environment - example code is not hardened for deployment and this file should be excluded from production build targets. If the function UA_Client_getRemoteDataTypes must be used, restrict execution to trusted local users only and enforce OS-level privilege separation to contain any exploit impact. Developers who need the functionality should reimplement it in the core codebase with proper memory lifetime management rather than adapting example code. For organizations that have already deployed binaries derived from this example, auditing memory allocation and deallocation ordering around UA_Client_getRemoteDataTypes is advised, and restricting local access to the host running the client is the most actionable near-term control.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's His
Remote memory exhaustion in open62541's FindServers Discovery Service lets an unauthenticated attacker crash or degrade
Uncontrolled memory consumption in open62541's OPC UA Discovery Service allows a remote, unauthenticated attacker to cra
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) du
Heap-based buffer overflow in open62541 up to version 1.5.5 allows local low-privileged attackers to corrupt heap memory
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a c
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today