EUVD-2026-51335
GHSA-hmp2-mjrw-2c5w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible OPC UA parsing, no authentication required to submit UA_Variant; write impact is integrity and availability, not confidentiality (CVE-2026-63559 covers the read side).
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Integer overflow in the UA_Variant arrayDimensions product computation in open62541 (versions 1.3.0-1.3.18, 1.4.0-1.4.17, 1.5.0-1.5.5) enables a remote attacker to trigger an out-of-bounds heap write, with potential for denial of service or arbitrary code execution in industrial OPC UA servers and gateways. CISA coordinated disclosure as ICSA-26-211-08 on 2026-07-30, citing risk to critical manufacturing, energy, and transportation infrastructure sectors worldwide. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is in the UA_Variant arrayDimensions product computation, which is exercised whenever the OPC UA stack processes a message containing a multi-dimensional array variant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CISA published a v3.1 CVSS score of 8.8 High for CVE-2026-65423, but the full CVSS vector string was not included in any available source - individual metric values are therefore inferred, not confirmed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an OPC UA server running an affected open62541 version sends a crafted OPC UA message containing UA_Variant data with manipulated arrayDimensions values whose product overflows the integer type, causing the library to allocate a buffer far smaller than the actual payload. The library then writes the full payload into this undersized buffer, corrupting adjacent heap memory - at minimum crashing the server process, and potentially enabling code execution depending on heap layout and platform mitigations. … |
| Remediation | The primary fix is to upgrade open62541 to v1.3.19, v1.4.18, or v1.5.6, all released 2026-07-27 and available at https://github.com/open62541/open62541/releases/tag/v1.3.19, https://github.com/open62541/open62541/releases/tag/v1.4.18, and https://github.com/open62541/open62541/releases/tag/v1.5.6 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running affected open62541 versions and implement emergency network isolation by restricting OPC UA server access to trusted sources only; enable continuous monitoring for anomalous OPC UA protocol activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today