A null pointer dereference resides in the responseReadNamespacesArray function of the shared client library of open62541. Sending a malformed Server_NamespaceArray argument triggers the dereference, causing the process to crash and effectively denying service. The weakness is a classic dereference of a null pointer (CWE-476) and an improper resource shutdown (CWE-404). The exploit requires remote communication, high complexity, and is currently considered difficult, although a public exploit may exist.

The issue exists in the open62541 shared client library, affecting all releases up to and including 1.5.5. The vulnerability is triggered in the file src/client/ua_client_connect.c, function responseReadNamespacesArray. No fixed version is listed in the data, so any installation of open62541 before the end of 1.5.5 remains susceptible.

The CVSS score of 2.3 signals low severity, and the EPSS score of less than 1% means the exploit probability is very low. The vulnerability is not catalogued in CISA's KEV list. Despite this low likelihood, an attacker who can reach the OPC UA service could send a specially crafted Server_NamespaceArray, causing the client to crash and interrupt service. The attack path is purely remote and requires complex payload construction, which limits widespread exploitation, but remains a risk for critical systems that depend on continuous availability.