CVE-2026-116014

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116014", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-24T11:23:55.329Z", "datePublished": "2026-10-24T11:40:32.200Z", "dateUpdated": "2026-10-29T16:08:24.942Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-24T11:40:32.200Z"}, "datePublic": "2026-08-14T21:34:28.000Z", "title": "open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType", "descriptions": [{"lang": "en", "value": "open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "open62541", "product": "open62541", "packageURL": "pkg:github/open62541/open62541", "defaultStatus": "unaffected", "versions": [{"version": "1.5.0", "lessThan": "1.5.7", "versionType": "semver", "status": "affected"}], "repo": "https://github.com/open62541/open62541"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.5.0", "versionEndExcluding": "1.5.7"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec", "tags": ["patch"]}, {"url": "https://github.com/open62541/open62541/pull/8298", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/open62541/open62541/pull/8302", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274", "tags": ["technical-description"]}, {"url": "https://github.com/open62541/open62541/releases/tag/v1.5.7", "tags": ["release-notes"], "name": "open62541 v1.5.7 Release Notes"}, {"name": "VulnCheck Advisory: open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype"}], "credits": [{"lang": "en", "value": "BUG|PWN Research", "type": "finder"}, {"lang": "en", "value": "Sadoc ADONON", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T16:05:02.417043Z", "id": "CVE-2026-116014", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T16:08:24.942Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116014", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T16:05:02.417043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T16:07:44.904Z"}}], "cna": {"title": "open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType", "credits": [{"lang": "en", "type": "finder", "value": "BUG|PWN Research"}, {"lang": "en", "type": "finder", "value": "Sadoc ADONON"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/open62541/open62541", "vendor": "open62541", "product": "open62541", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "1.5.7", "versionType": "semver"}], "packageURL": "pkg:github/open62541/open62541", "defaultStatus": "unaffected"}], "datePublic": "2026-08-14T21:34:28.000Z", "references": [{"url": "https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec", "tags": ["patch"]}, {"url": "https://github.com/open62541/open62541/pull/8298", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/open62541/open62541/pull/8302", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274", "tags": ["technical-description"]}, {"url": "https://github.com/open62541/open62541/releases/tag/v1.5.7", "name": "open62541 v1.5.7 Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype", "name": "VulnCheck Advisory: open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.5.7", "versionStartIncluding": "1.5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-24T11:40:32.200Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116014", "state": "PUBLISHED", "dateUpdated": "2026-10-29T16:08:24.942Z", "dateReserved": "2026-10-24T11:23:55.329Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-24T11:40:32.200Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/open62541/open62541", "product": "open62541", "repo": "https://github.com/open62541/open62541", "vendor": "open62541", "versions": [{"lessThan": "1.5.7", "status": "affected", "version": "1.5.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution."}], "id": "CVE-2026-116014", "lastModified": "2026-10-29T17:18:01.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116014", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T16:05:02.417043Z", "version": "2.0.3"}}]}, "published": "2026-10-24T12:16:57.607", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/open62541/open62541/pull/8298"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/open62541/open62541/pull/8302"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/open62541/open62541/releases/tag/v1.5.7"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "open62541: open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType", "id": "2560284", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560284"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.", "A flaw was found in open62541. This vulnerability allows a malicious Open Platform Communications Unified Architecture (OPC UA) server to trigger arbitrary code execution or a Denial of Service (DoS) on connecting client applications. By supplying specially crafted, oversized custom data type definitions, the server induces an integer overflow during decoding that results in a heap-based buffer overflow."], "name": "CVE-2026-116014", "public_date": "2026-10-24T11:40:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116014\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116014\nhttps://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274\nhttps://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec\nhttps://github.com/open62541/open62541/pull/8298\nhttps://github.com/open62541/open62541/pull/8302\nhttps://github.com/open62541/open62541/releases/tag/v1.5.7\nhttps://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype"], "statement": "This vulnerability is rated as Critical severity because successful exploitation allows an untrusted remote server to induce heap memory corruption, potentially leading to arbitrary code execution or complete service denial on the connecting client without requiring user privileges. In typical Red Hat enterprise environments, open62541 is not shipped as part of core distributions, significantly constraining the overall attack surface. Risk is further conditioned on client applications actively establishing communication with untrusted or compromised endpoints and requesting dynamic data type definitions.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0,1.5.7)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "open62541", "source": "cna", "vendor": "open62541"}, "product": "open62541", "vendor": "open62541"}], "created": "2026-10-24T12:45:06.739589+00:00", "updated": "2026-11-03T14:30:08.639408+00:00", "vendors": ["open62541", "open62541$PRODUCT$open62541"]}