EUVD-2026-51332
Integer Overflow or Wraparound (CWE-190)
2026-07-30
GHSA-6c97-xqf2-q99q
GHSA-6c97-xqf2-q99q
8.7
CVSS 4.0 · Vendor
Share
Severity by source
Vendor (CNA)
PRIMARY
8.7
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today
AI
7.5
HIGH
Remote unauthenticated crafted Variant over the OPC UA network path (AV:N/AC:L/PR:N/UI:N); heap read yields high confidentiality impact only, with no integrity or availability effect.
3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X
Lifecycle Timeline
6
Source Code Evidence Fetched
Jul 30, 2026 - 22:48 vuln.today
Analysis Updated
Jul 30, 2026 - 22:48 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 22:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 22:37 NVD
8.7 (HIGH)
Analysis Generated
Jul 30, 2026 - 20:16 vuln.today
CVE Published
Jul 30, 2026 - 19:39 oss-security
CRITICAL
Description PRE-NVD
Disclosed via oss-security. NVD scoring and full description are pending.
AnalysisAI
Out-of-bounds heap read in the open62541 OPC UA C library allows a remote unauthenticated attacker to disclose sensitive process memory by supplying a crafted UA_Variant whose arrayDimensions provoke an integer overflow in the dimension-product computation. The overflow makes the computed element/stride total wrap to a small value, so bounds checks pass and subsequent index math walks past the heap allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Reach OPC UA endpoint over network
Delivery
Send crafted UA_Variant with malicious arrayDimensions
Exploit
Trigger integer overflow in dimension product
Execution
Bounds check wraps and passes
Persist
Read out-of-bounds heap memory
Impact
Exfiltrate disclosed sensitive data
Access
Reach OPC UA endpoint over network
Delivery
Send crafted UA_Variant with malicious arrayDimensions
Exploit
Trigger integer overflow in dimension product
Execution
Bounds check wraps and passes
Persist
Read out-of-bounds heap memory
Impact
Exfiltrate disclosed sensitive data
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to send an OPC UA message containing a UA_Variant that carries an arrayDimensions field with dimension values crafted so their multiplied product overflows SIZE_MAX and wraps - the vulnerable code paths are Variant range adjustment (checkAdjustRange/computeStrides) and Variant binary decode/encode, so the target must process attacker-supplied Variants (a standard OPC UA server data path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a genuinely remote, low-complexity, unauthenticated attack path - a strong prioritization signal for internet- or network-reachable OPC UA servers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an OPC UA server sends a message containing a UA_Variant whose arrayDimensions are chosen so their product overflows SIZE_MAX and wraps to a small value; the undersized bounds check passes and the server, while processing ranges or encoding the Variant, reads beyond the heap allocation and returns adjacent memory contents to the attacker. Given AV:N/AC:L/PR:N/UI:N, this requires only reachability and a single crafted request with no authentication or user interaction. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - rebuild open62541 from a revision that includes the overflow guards from pull requests 8235-8238 (commit b666d357 in PR 8235 plus the companion commits 06b99fef, 1b71d9c5, and afab4107), which add 'value > SIZE_MAX / dims[i]' checks before every dimension multiplication in checkAdjustRange, computeStrides, and the Variant binary encode/decode routines. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems using open62541 and determine which have OPC UA endpoints exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).