open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.5.7
- Public exploit
- None on Exploit-DB
Summary
open62541, an open-source OPC UA library used in industrial and automation software, is affected. A malicious server can exploit a flaw in how client applications process custom data type definitions to corrupt memory, which could crash the client or potentially allow an attacker to run arbitrary code.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
Affected versions
- open62541 open62541
From 1.5.0 · fixed in 1.5.7