open62541 CVE-2026-65423

The vulnerability is in the UA_Variant arrayDimensions product computation, which is exercised whenever the OPC UA stack processes a message containing a multi-dimensional array variant. UA_Variant is used across many OPC UA services (Read, Write, method calls, subscription data), so the precise entry point is not narrowed by available data. The CISA advisory states 'remote attacker' without specifying a required authentication level, and the exact CVSS vector is not published - authentication requirements are not confirmed from available data. There is no stated requirement for a non-default build configuration for this specific CVE (unlike CVE-2026-63362, which requires PubSub encryption to be compiled in). What limits exploitation: the server must be running an affected version prior to v1.3.19/v1.4.18/v1.5.6; network access to an OPC UA endpoint (default TCP port 4840, or alternate MQTT/UDP transports) is required; platform heap mitigations (ASLR, guard pages) on modern Linux or Windows may prevent code execution even if the write succeeds, reducing reliable impact to denial of service. The specific OPC UA service message type that reaches the vulnerable computation is not identified in available sources.

CISA published a v3.1 CVSS score of 8.8 High for CVE-2026-65423, but the full CVSS vector string was not included in any available source - individual metric values are therefore inferred, not confirmed. An 8.8 score with S:U is consistent with a network-accessible, low-complexity attack requiring low privileges with high integrity and availability impact (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though PR:N with reduced confidentiality impact also approaches 8.8. The out-of-bounds write primitive in a C library is theoretically exploitable for code execution but is not proven in the available reporting - CISA characterizes it as 'potentially execute arbitrary code.' EPSS data is absent from available inputs, so exploitation probability cannot be quantified from that signal. The CVE is not in CISA KEV, meaning active exploitation is not confirmed. PoC code exists (credited to Asher Davila and Malav Vyas) but is withheld, making weaponization timeline unknown. Real-world risk is amplified by open62541's role as an embedded library across many downstream ICS vendors (named but not disclosed in the oss-security report), by the criticality of the industrial sectors affected, and by the fact that OPC UA endpoints are often exposed on operational technology networks with minimal egress filtering. CVSS score versus actual exploitability is a genuine uncertainty here - the write primitive is real but code execution has not been demonstrated publicly.

An attacker with network access to an OPC UA server running an affected open62541 version sends a crafted OPC UA message containing UA_Variant data with manipulated arrayDimensions values whose product overflows the integer type, causing the library to allocate a buffer far smaller than the actual payload. The library then writes the full payload into this undersized buffer, corrupting adjacent heap memory - at minimum crashing the server process, and potentially enabling code execution depending on heap layout and platform mitigations. PoC code for this class of integer-overflow-to-heap-write exists but has been withheld at the vendor's request.