Technical impact
A use‑after‑free vulnerability has been identified in the UA_Client_getRemoteDataTypes function within examples/custom_datatype/client_types_custom.c of the open62541 library. Executing a manipulation can trigger the use‑after‑free, allowing an attacker to corrupt memory and potentially alter program execution flow. The flaw is local only, meaning an attacker must be able to run code on the host that runs the vulnerable client code.
Affected Systems
The flaw resides in the open62541 project, specifically in the commit ca356b088ada7dee824d1b4acd07c1ff07ce242b. Any installation that includes the examples/custom_datatype client code and has not applied a version of the library that removes the vulnerable code path is impacted. No specific released versions are listed in the CVE data, so the risk applies to affected implementations that match the described code path.
Risk and Exploitability
The CVSS base score is 4.8, classifying the issue as medium severity. The EPSS score of 0.00112 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting it is not widely exploited in the wild. The attack can only be mounted from the local host, implying that an attacker with local access could trigger the flaw. Given the use‑after‑free nature, exploitation could lead to memory corruption or arbitrary code execution, but the impact remains constrained by the local execution requirement and the absence of a remote trigger.
