The flaw arises from the Apache PLC4X Java implementation allocating memory and stack space based on size values supplied by an external PLC device without validating those values. Length‑prefixed byte strings, array fields, and recursive protocol types are parsed with no bounds, allowing an attacker to instruct the client to allocate huge data structures or recurse deeply. This results in the client consuming excessive memory or stack resources, ultimately causing a denial of service. The vulnerability is CWE‑770, and CWE‑789.

The affected product is Apache PLC4X, specifically the PLC4J Java implementation and its OPC UA driver. All releases from version 0.10.0 up to but excluding 1.0.0 are vulnerable, with the most recent affected binaries in the 0.13.1 series. The damage manifests when a device speaks to the client before authentication, so any system that hosts a PLC4J client communicating with PLC devices could be impacted.

The CVSS base score of 8.7 indicates a high severity risk. The EPSS score is not available, but the ability to trigger the flaw before authentication and over an open network suggests a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet an attacker can impersonate a trusted PLC device and initiate the exploit solely through network traffic, making the attack vector relatively straightforward.