Executive brief
open62541 is an open-source OPC UA library used in industrial control systems, gateways, and diagnostic tools to communicate with servers. A malicious OPC UA server can trigger a heap-based buffer over-read in the client library when reading node class attributes, causing the client process to crash and resulting in denial of service of critical industrial infrastructure components.
Technical details
A heap buffer over-read exists in the __Client_readAttribute() function in src/client/ua_client_highlevel.c. The vulnerable code path for UA_ATTRIBUTEID_NODECLASS skips type validation and unconditionally reads sizeof(UA_NodeClass) bytes (4 bytes) from a variant field without confirming the variant actually contains a NodeClass type. If a malicious server responds with a Boolean (1 byte) instead, a 4-byte out-of-bounds read occurs. The attack is reachable via a real OPC UA TCP handshake (HEL/ACK → OpenSecureChannel → FindServers → GetEndpoints → Read). The primary impact is remote denial of service; industrial clients connecting to untrusted or compromised servers are at risk. Patches are expected from the open62541 project.
Affected products
- open62541 open62541 up to 1.5.5
Timeline
- 2026-08-04: disclosed: Published on NVD
- 2026: other: Exploit made public; project report closed, stating not official reporting channel