EUVD-2026-51332
GHSA-6c97-xqf2-q99q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OPC UA endpoint over network
-
DeliverySend crafted UA_Variant with malicious arrayDimensions
-
ExploitTrigger integer overflow in dimension product
-
ExecutionBounds check wraps and passes
-
PersistRead out-of-bounds heap memory
-
ImpactExfiltrate disclosed sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to send an OPC UA message containing a UA_Variant that carries an arrayDimensions field with dimension values crafted so their multiplied product overflows SIZE_MAX and wraps - the vulnerable code paths are Variant range adjustment (checkAdjustRange/computeStrides) and Variant binary decode/encode, so the target must process attacker-supplied Variants (a standard OPC UA server data path). Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special configuration are required against a reachable server. Limiting factors: exploitation requires network reachability of the OPC UA endpoint (often confined to OT/industrial segments), the impact is limited to reading heap memory (no write/execution), and deployments that enforce OPC UA authentication/encryption or firewall the endpoint materially raise the bar. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a genuinely remote, low-complexity, unauthenticated attack path - a strong prioritization signal for internet- or network-reachable OPC UA servers. Impact is bounded: VC:H but VI:N/VA:N, i.e., information disclosure only, no integrity or availability effect, which caps real-world severity below a code-execution or DoS bug. EPSS and KEV data were not supplied; absence of KEV plus no identified POC means this is not confirmed as actively exploited, so risk is driven by exposure rather than observed campaigns. The strongest mitigating reality is deployment context: many open62541 servers sit on segmented OT networks rather than the open internet, so the AV:N rating overstates practical reachability for well-segmented sites. No EPSS/SSVC values were provided to refine this - treat the network-vector reachability as configuration-dependent and verify per deployment. |
| Exploit ScenarioDerived | An attacker with network access to an OPC UA server sends a message containing a UA_Variant whose arrayDimensions are chosen so their product overflows SIZE_MAX and wraps to a small value; the undersized bounds check passes and the server, while processing ranges or encoding the Variant, reads beyond the heap allocation and returns adjacent memory contents to the attacker. Given AV:N/AC:L/PR:N/UI:N, this requires only reachability and a single crafted request with no authentication or user interaction. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 30, 2026
Out-of-bounds heap read in the open62541 OPC UA C library allows a remote unauthenticated attacker to disclose sensitive process memory by supplying a crafted UA_Variant whose arrayDimensions provoke an integer overflow in the dimension-product computation. The overflow makes the computed element/stride total wrap to a small value, so bounds checks pass and subsequent index math walks past the heap allocation. CVSS 4.0 is 8.7 (confidentiality-only impact); no public exploit identified at time of analysis, though it is tracked in a CISA ICS advisory (ICSA-26-211-08) given the industrial/OT exposure of OPC UA servers.
Earlier versions of this analysis (1)
Out-of-bounds heap read in open62541's UA_Variant arrayDimensions parsing allows a remote attacker to disclose memory contents from affected OPC UA servers running versions 1.3.0-1.3.18, 1.4.0-1.4.17, and 1.5.0-1.5.5 on Windows and Linux. CVE-2026-63559 is the read-side companion to CVE-2026-65423 (out-of-bounds write): both stem from the same integer overflow in the arrayDimensions product computation within UA_Variant handling, and both are fixed by a single upstream commit. No active exploitation is confirmed, PoC is withheld at vendor request, and CISA coordinated the disclosure under ICSA-26-211-08 citing impact to Critical Manufacturing, Energy, and Transportation infrastructure.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - rebuild open62541 from a revision that includes the overflow guards from pull requests 8235-8238 (commit b666d357 in PR 8235 plus the companion commits 06b99fef, 1b71d9c5, and afab4107), which add 'value > SIZE_MAX / dims[i]' checks before every dimension multiplication in checkAdjustRange, computeStrides, and the Variant binary encode/decode routines. Because no tagged release version is confirmed in the input, pin to the fixed commit or a subsequent release that references these PRs rather than assuming a version number. Until patched, reduce exposure by restricting network reachability of the OPC UA endpoint (bind to management/OT VLANs only, firewall the OPC UA TCP port - default 4840 - to trusted clients), and enable OPC UA security policies that require client authentication/encryption so anonymous crafted-Variant traffic is rejected before decode; note the trade-off that enforcing authentication breaks anonymous clients and endpoint segmentation may disrupt existing integrations. Track vendor guidance via the oss-security post (https://seclists.org/oss-sec/2026/q3/350) and the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
open62541 is a widely used open-source C99 implementation of OPC UA (OPC Unified Architecture), the machine-to-machine protocol standard for industrial automation and OT environments. The defect is a classic CWE-190 integer overflow: when computing the total number of array elements as the product of arrayDimensions[i] (in checkAdjustRange, computeStrides, and the binary encode/decode paths in ua_types.c and ua_types_encoding_binary.c), the running product can exceed SIZE_MAX and wrap. The source evidence shows the fixes adding per-factor guards of the form 'if(dims[i] != 0 && running > SIZE_MAX / dims[i]) return error', confirming the root cause is unchecked multiplication of attacker-controlled dimension values that feeds size/stride calculations used to index heap buffers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated crafted Variant over the OPC UA network path (AV:N/AC:L/PR:N/UI:N); heap read yields high confidentiality impact only, with no integrity or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
The open62541 OPC UA library contains a critical memory disclosure vulnerability (CVE-2026-63559, CVSS 8.7) enabling remote, unauthenticated attackers to read sensitive process memory. Organizations operating OPC UA servers-particularly in industrial and critical infrastructure-face exposure of operational data that could enable system compromise or downstream attacks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict OPC UA endpoint network access to trusted nodes only via firewall rules and network segmentation; implement detailed logging and real-time monitoring for suspicious OPC UA connection patterns and malformed UA_Variant requests; disable OPC UA services on systems where not operationally required; isolate OPC UA servers from networks containing sensitive information systems; apply strict input validation to OPC UA requests where application-level controls are available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB