Executive brief
open62541 is an open-source OPC UA protocol implementation used in industrial control systems and IoT devices for real-time data exchange. A malicious or compromised OPC UA server can crash a client application by sending a specially crafted sequence of data-type definitions that causes unbounded recursion and stack exhaustion, resulting in a denial of service and potentially disrupting critical operations that depend on the client.
Technical details
The vulnerability is a stack overflow caused by unbounded recursive traversal in the UA_Client_getRemoteDataTypes() function. When discovering remote custom data types, the code recursively walks the DataType→HasSubtype graph via the browseDataTypesRecursive() helper without enforcing any recursion-depth limit or work queue bounds. A malicious server can return an ever-growing sequence of previously unseen NodeIds in its Browse responses, bypassing the visited-node de-duplication check and forcing the client into infinite recursion. The vulnerability requires the client to call UA_Client_getRemoteDataTypes() after establishing a valid OPC UA session, and it is exploitable by any remote OPC UA server endpoint. The official example client examples/custom_datatype/client_types_custom.c is affected by default.
Affected products
- open62541 open62541 commit ca356b088ada7dee824d1b4acd07c1ff07ce242b and later
Timeline
- 2026-08-04: disclosed: CVE-2026-18785 published
- 2026-08-04: other: Advisory disclosed, project stated this is not an official security report channel