Is CVE-2026-63559 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63559 being exploited in the wild.

How severe is CVE-2026-63559?

High severity, with a CVSS score of 7.5, published 30 July 2026.

Which products and versions are affected?

o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch.

Is there a fix for CVE-2026-63559?

A patch was published on 2026-05-11: Initial fix commits authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63559 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63559?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63559: o6 Automation open62541 integer overflow in UA_Variant arrayDimensions

CVE-2026-63559 · Severity: high · CVSS 7.5 · Published 2026-07-30

open62541 is an open-source implementation of the OPC UA industrial communication protocol used in manufacturing and automation. A flaw in how the software handles complex data structures could allow a remote attacker to read sensitive information from the system's memory. This could lead to the exposure of internal configuration data or other confidential information processed by the industrial control system.

Quick answers

Is CVE-2026-63559 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63559 being exploited in the wild.
How severe is CVE-2026-63559?: High severity, with a CVSS score of 7.5, published 30 July 2026.
Which products and versions are affected?: o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch.
Is there a fix for CVE-2026-63559?: A patch was published on 2026-05-11: Initial fix commits authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63559 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63559?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the open62541 library within the UA_Variant arrayDimensions product computation. The flaw occurs when multiplying attacker-controlled arrayDimensions values into a size_t accumulator without sufficient overflow checks, causing the product to wrap and match a smaller-than-expected arrayLength. A remote, unauthenticated attacker can exploit this during Variant binary decoding or encoding to trigger an out-of-bounds heap read. This can result in the disclosure of sensitive memory contents. The issue has been addressed in multiple branches (1.3, 1.4, 1.5, and master) by implementing checked multiplication at all sites where the dimension product is computed.

Affected products

o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch

Timeline

2026-05-11: patched: Initial fix commits authored
2026-07-23: patched: Fixes merged into 1.3 and 1.4 branches
2026-07-24: patched: Fixes merged into 1.5 branch
2026-07-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.