CVE-2026-116014
Description
A flaw was found in open62541. This vulnerability allows a malicious Open Platform Communications Unified Architecture (OPC UA) server to trigger arbitrary code execution or a Denial of Service (DoS) on connecting client applications. By supplying specially crafted, oversized custom data type definitions, the server induces an integer overflow during decoding that results in a heap-based buffer overflow.
Statement
This vulnerability is rated as Critical severity because successful exploitation allows an untrusted remote server to induce heap memory corruption, potentially leading to arbitrary code execution or complete service denial on the connecting client without requiring user privileges. In typical Red Hat enterprise environments, open62541 is not shipped as part of core distributions, significantly constraining the overall attack surface. Risk is further conditioned on client applications actively establishing communication with untrusted or compromised endpoints and requesting dynamic data type definitions.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce bounds on custom DataType structure sizes and field counts before memory allocation in open62541 custom type parsing: upgrade to open62541 1.5.7, which calculate running sizes using size_t and reject definitions with BADENCODINGLIMITSEXCEEDED if cumulative size exceeds UA_UINT16_MAX or field count exceeds 255, closing all 3 injection vectors (oversized custom structure definitions exceeding 65535 bytes, custom structure definitions with more than 255 fields, crafted custom enum data type definitions). Until patched, this is a concern on open62541 client applications querying dynamic remote data types, so restrict client connections to trusted OPC UA servers and avoid invoking dynamic remote data type querying via UA_Client_getRemoteDataTypes() against unverified endpoints. As a compensating measure, enable Address Space Layout Randomization (ASLR) to randomize client application memory layout, compile binaries with full RELRO and PIE to enforce a read-only GOT and randomize code addresses, enable Control Flow Integrity (CFI) or Shadow Call Stack to restrict indirect branch targets, and build with compiler integer overflow and conversion safety checks (-ftrapv or UBSan Integer) to trap on memSize overflow and membersSize truncation. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow and truncation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
