Is CVE-2026-18785 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18785 being exploited in the wild.

How severe is CVE-2026-18785?

Medium severity, with a CVSS score of 5.3, published 4 August 2026.

Which products and versions are affected?

open62541 open62541 commit ca356b088ada7dee824d1b4acd07c1ff07ce242b and later.

Is there a fix for CVE-2026-18785?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18785 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18785?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18785: open62541 client stack overflow in UA_Client_getRemoteDataTypes

CVE-2026-18785 · Severity: medium · CVSS 5.3 · Published 2026-08-04

open62541 is an open-source OPC UA protocol implementation used in industrial control systems and IoT devices for real-time data exchange. A malicious or compromised OPC UA server can crash a client application by sending a specially crafted sequence of data-type definitions that causes unbounded recursion and stack exhaustion, resulting in a denial of service and potentially disrupting critical operations that depend on the client.

Quick answers

Is CVE-2026-18785 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18785 being exploited in the wild.
How severe is CVE-2026-18785?: Medium severity, with a CVSS score of 5.3, published 4 August 2026.
Which products and versions are affected?: open62541 open62541 commit ca356b088ada7dee824d1b4acd07c1ff07ce242b and later.
Is there a fix for CVE-2026-18785?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18785 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18785?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack overflow caused by unbounded recursive traversal in the UA_Client_getRemoteDataTypes() function. When discovering remote custom data types, the code recursively walks the DataType→HasSubtype graph via the browseDataTypesRecursive() helper without enforcing any recursion-depth limit or work queue bounds. A malicious server can return an ever-growing sequence of previously unseen NodeIds in its Browse responses, bypassing the visited-node de-duplication check and forcing the client into infinite recursion. The vulnerability requires the client to call UA_Client_getRemoteDataTypes() after establishing a valid OPC UA session, and it is exploitable by any remote OPC UA server endpoint. The official example client examples/custom_datatype/client_types_custom.c is affected by default.

Affected products

open62541 open62541 commit ca356b088ada7dee824d1b4acd07c1ff07ce242b and later

Timeline

2026-08-04: disclosed: CVE-2026-18785 published
2026-08-04: other: Advisory disclosed, project stated this is not an official security report channel

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.