An issue in open62541, affecting versions 1.5.5 and earlier, allows a remote attacker to trigger a DoS condition by abusing the UA_Client_getRemoteDataTypes component. The flaw causes the target application to terminate or become unresponsive, compromising availability and potentially disrupting any services that rely on the affected OPC UA client or server.

The vulnerability impacts the open62541 OPC UA stack, specifically all releases up to and including 1.5.5. Any installation that uses the UA_Client_getRemoteDataTypes interface without a later fixed version is susceptible.

The CVSS score of 7.5 reflects a moderate to high severity, and no EPSS value is currently reported, suggesting that publicly available exploitation data is not known. The vulnerability is not listed in the CISA KEV catalog, but remote exploitation requires network connectivity to the OPC UA endpoint, making it potentially reachable in exposed environments. A remote attacker could send crafted type discovery requests to exhaust resources or crash the client, yielding a denial of service impact.