Technical impact
open62541 versions 1.5.0 through 1.5.6 contain an integer overflow in the function that parses custom data type definitions. The 16‑bit memory size field is wrapped for large custom structures, allowing a malicious OPC UA server to send a crafted definition that causes a heap buffer overflow during decoding. The overflow can corrupt the heap and crash the client or, more critically, enable arbitrary code execution on the client machine.
Affected Systems
The vulnerability affects the open62541 open62541 library, specifically releases 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, and 1.5.6. Any system that integrates one of these versions and connects to an OPC UA server capable of supplying custom data type definitions is impacted.
Risk and Exploitability
The CVSS base score of 9.2 categorizes this flaw as critical. The EPSS score is 0.00432, and the vulnerability is not yet listed in the CISA KEV catalog, but the attack vector is straightforward for a compromised or hostile server. Based on the description, it is inferred that an attacker who controls or compromises an OPC UA server can trigger the overflow by sending malicious custom data type definitions, potentially leading to a denial of service or arbitrary code execution on connected clients. The lack of an official exploit does not reduce the inherent risk given the high severity and the ability to exploit remotely via the OPC UA protocol.
