Junglewise Threat Intelligence

CVE-2026-63362: o6 Automation open62541 integer underflow in PubSub signature verification

CVE-2026-63362 · Severity: medium · CVSS 5.9 · Published 2026-07-30

Executive brief

open62541 is an open-source implementation of OPC UA, a standard used for industrial communication between machines. A vulnerability in how the software verifies digital signatures could allow a remote attacker to crash the service by sending a specially crafted network packet. This could lead to a denial of service, disrupting industrial operations and monitoring systems that rely on this library.

Technical details

An unsigned integer underflow exists in the `verifyAndDecrypt()` function within the PubSub security component of open62541. The vulnerability occurs when the length of an incoming message buffer is smaller than the expected signature size, leading to a wrap-around during subtraction. This results in a large `size_t` value being passed to subsequent cryptographic operations (such as mbedtls), which can cause the application to read unmapped memory and crash. The attack is reachable via crafted UDP packets if PubSub signature verification is enabled. Patches have been merged into the 1.3, 1.4, 1.5, and master branches to include proper bounds checking before subtraction.

Affected products

  • o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch

Timeline

  • 2026-05-11: other: Fixes developed in pull requests
  • 2026-07-23: patched: Fixes merged into main branches
  • 2026-07-30: disclosed: CVE published to NVD

References