open62541 EUVD-2026-41326

Exploitation requires network access to the OPC UA Discovery Service endpoint (GetEndpoints, typically TCP 4840) of a server running a vulnerable open62541 build (1.4.0-1.4.16, 1.5.0-1.5.4, or master). The specific trigger is a GetEndpointsRequest whose endpointUrl UInt32 length field declares an oversized string (up to ~4.09 GB), delivered as intermediate SecureConversation chunks with the final chunk deliberately withheld. Per CVSS AV:N/AC:L/PR:N/UI:N, there are no special conditions beyond reachability - no authentication, no session, and no particular encryption or configuration is needed, since the attack is pre-session and bypasses all encryption configurations. The main limiting factors are network exposure of the OPC UA port and available server RAM, plus the SecureChannel timeout which eventually frees buffered chunks, so effective attacks require sustained or parallelized connections.

The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), consistent with a pure availability-impact, unauthenticated, low-complexity network attack - an accurate characterization given the description confirms the attack is remote, pre-session, and requires no credentials. No EPSS score was supplied and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no public POC was provided either, meaning both exploitation-probability signals are currently absent or unknown. The realistic risk is driven by exposure rather than sophistication: the technique is conceptually simple (declare a huge length, withhold the final chunk), so weaponization is plausible, but impact is confined to denial of service - no confidentiality or integrity loss. Priority should therefore scale with how exposed the OPC UA endpoint is: internet- or plant-network-reachable servers with limited RAM warrant prompt patching, while segmented OT deployments face lower practical risk. Note the SecureChannel timeout provides a natural (though slow) release valve, which somewhat limits sustained impact unless the attacker opens many parallel channels.

An attacker with network reachability to an exposed OPC UA server sends a GetEndpointsRequest declaring a multi-gigabyte endpointUrl length, then streams intermediate message chunks while deliberately never transmitting the final chunk. The server buffers each chunk in RAM and holds them until the SecureChannel times out; by opening many such channels in parallel the attacker drives memory exhaustion and denial of service. No authentication, user interaction, or valid credentials are required, and no public POC is currently known.