Is CVE-2026-63362 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63362 being exploited in the wild.

How severe is CVE-2026-63362?

Medium severity, with a CVSS score of 5.9, published 30 July 2026.

Which products and versions are affected?

o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch.

Is there a fix for CVE-2026-63362?

A patch was published on 2026-07-23: Fixes merged into main branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63362 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63362?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63362: o6 Automation open62541 integer underflow in PubSub signature verification

CVE-2026-63362 · Severity: medium · CVSS 5.9 · Published 2026-07-30

open62541 is an open-source implementation of OPC UA, a standard used for industrial communication between machines. A vulnerability in how the software verifies digital signatures could allow a remote attacker to crash the service by sending a specially crafted network packet. This could lead to a denial of service, disrupting industrial operations and monitoring systems that rely on this library.

Quick answers

Is CVE-2026-63362 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63362 being exploited in the wild.
How severe is CVE-2026-63362?: Medium severity, with a CVSS score of 5.9, published 30 July 2026.
Which products and versions are affected?: o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch.
Is there a fix for CVE-2026-63362?: A patch was published on 2026-07-23: Fixes merged into main branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63362 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63362?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unsigned integer underflow exists in the `verifyAndDecrypt()` function within the PubSub security component of open62541. The vulnerability occurs when the length of an incoming message buffer is smaller than the expected signature size, leading to a wrap-around during subtraction. This results in a large `size_t` value being passed to subsequent cryptographic operations (such as mbedtls), which can cause the application to read unmapped memory and crash. The attack is reachable via crafted UDP packets if PubSub signature verification is enabled. Patches have been merged into the 1.3, 1.4, 1.5, and master branches to include proper bounds checking before subtraction.

Affected products

o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch

Timeline

2026-05-11: other: Fixes developed in pull requests
2026-07-23: patched: Fixes merged into main branches
2026-07-30: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.