The client-side function responseReadNamespacesArray() in open62541 1.5.5 performs an out-of-bounds read by incorrectly indexing an array while parsing a server response. This bug can allow an attacker to read arbitrary memory content that the client process holds, resulting in disclosure of potentially sensitive data. The vulnerability is limited to the client side and requires delivery of a crafted server response to the vulnerable client.

The vulnerability affects the open62541 OPC UA client library version 1.5.5. Any application that links against this specific library version and processes namespace array responses is impacted. No proprietary vendor is listed, so the issue is present in all builds of open62541 1.5.5 unless patched.

The CVSS score of 7.5 categorizes this as high severity. While an EPSS score is not provided, the lack of a KEV listing suggests that exploitation has not yet been observed in the wild, but the vulnerability remains exploitable from any network point where the client can be made to contact a malicious server. An attacker could send a malformed response to the OPC UA client to trigger the out-of-bounds read and retrieve data from the client’s memory space.