CVE-2026-18785

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18785", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-04T08:30:07.756Z", "datePublished": "2026-08-04T16:45:08.749Z", "dateUpdated": "2026-08-04T17:35:15.212Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-04T16:45:08.749Z"}, "title": "o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "Use After Free"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "o6", "product": "open62541", "versions": [{"version": "ca356b088ada7dee824d1b4acd07c1ff07ce242b", "status": "affected"}], "cpes": ["cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-04T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-04T10:53:57.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Chuan Wei (SCU)", "type": "finder"}, {"lang": "en", "value": "VULL (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "SCU_1CP (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/385787", "name": "VDB-385787 | o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385787/cti", "name": "VDB-385787 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18785", "name": "CVE-2026-18785 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/857052", "name": "Submit #857052 | open62541 Project open62541 master (commit ca356b088ada7dee824d1b4acd07c1ff07ce242b) Uncontrolled Recursion (Stack Overflow)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/open62541/open62541/issues/8131", "tags": ["issue-tracking"]}, {"url": "https://github.com/gff-cw/information/issues/12", "tags": ["exploit", "issue-tracking"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/857052", "tags": ["exploit"]}, {"url": "https://github.com/open62541/open62541/issues/8131", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T17:30:52.782290Z", "id": "CVE-2026-18785", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:35:15.212Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18785", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T17:30:52.782290Z"}}}], "references": [{"url": "https://vuldb.com/submit/857052", "tags": ["exploit"]}, {"url": "https://github.com/open62541/open62541/issues/8131", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:30:36.477Z"}}], "cna": {"title": "o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free", "credits": [{"lang": "en", "type": "finder", "value": "Chuan Wei (SCU)"}, {"lang": "en", "type": "reporter", "value": "VULL (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "SCU_1CP (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*"], "vendor": "o6", "product": "open62541", "versions": [{"status": "affected", "version": "ca356b088ada7dee824d1b4acd07c1ff07ce242b"}]}], "timeline": [{"lang": "en", "time": "2026-08-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-04T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-04T10:53:57.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/385787", "name": "VDB-385787 | o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385787/cti", "name": "VDB-385787 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18785", "name": "CVE-2026-18785 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/857052", "name": "Submit #857052 | open62541 Project open62541 master (commit ca356b088ada7dee824d1b4acd07c1ff07ce242b) Uncontrolled Recursion (Stack Overflow)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/open62541/open62541/issues/8131", "tags": ["issue-tracking"]}, {"url": "https://github.com/gff-cw/information/issues/12", "tags": ["exploit", "issue-tracking"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-04T16:45:08.749Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18785", "state": "PUBLISHED", "dateUpdated": "2026-08-04T17:35:15.212Z", "dateReserved": "2026-08-04T08:30:07.756Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-04T16:45:08.749Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*"], "product": "open62541", "vendor": "o6", "versions": [{"status": "affected", "version": "ca356b088ada7dee824d1b4acd07c1ff07ce242b"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Afectada es la funci\u00f3n UA_Client_getRemoteDataTypes del archivo examples/custom_datatype/client_types_custom.c. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a un uso despu\u00e9s de liberaci\u00f3n. Es posible lanzar el ataque en el host local. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proyecto cerr\u00f3 el informe del problema, afirmando que esta no es la forma oficial de reportar una vulnerabilidad de seguridad."}], "id": "CVE-2026-18785", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18785", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T17:30:52.782290Z", "version": "2.0.3"}}]}, "published": "2026-08-04T17:16:48.650", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/gff-cw/information/issues/12"}, {"source": "cna@vuldb.com", "url": "https://github.com/open62541/open62541/issues/8131"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-18785"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/857052"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385787"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385787/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open62541/open62541/issues/8131"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://vuldb.com/submit/857052"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-416"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "open62541: open62541: Use-after-free vulnerability via local manipulation", "id": "2511141", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511141"}, "csaw": false, "cwe": "CWE-825", "details": ["A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability.", "A flaw was found in open62541. A local attacker can exploit a use-after-free vulnerability in the UA_Client_getRemoteDataTypes function by performing a specific manipulation. This could potentially lead to limited information disclosure, data corruption, or a Denial of Service (DoS)."], "name": "CVE-2026-18785", "public_date": "2026-08-04T16:45:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-18785\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18785\nhttps://github.com/gff-cw/information/issues/12\nhttps://github.com/open62541/open62541/issues/8131\nhttps://vuldb.com/cve/CVE-2026-18785\nhttps://vuldb.com/submit/857052\nhttps://vuldb.com/vuln/385787\nhttps://vuldb.com/vuln/385787/cti"], "statement": "This Moderate severity use-after-free flaw in open62541 allows a local attacker to trigger a crash or potentially corrupt data through specific manipulation of the UA_Client_getRemoteDataTypes function. While publicly disclosed, exploitation requires local access and specific conditions, limiting its broader impact on typical Red Hat deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ca356b088ada7dee824d1b4acd07c1ff07ce242b"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "open62541", "source": "cna", "vendor": "o6"}, "product": "open62541", "vendor": "open62541"}], "created": "2026-08-04T20:00:04.814710+00:00", "updated": "2026-08-07T01:45:05.276293+00:00", "vendors": ["open62541", "open62541$PRODUCT$open62541"]}