Junglewise Threat Intelligence

CVE-2026-63559: o6 Automation open62541 integer overflow in UA_Variant arrayDimensions

CVE-2026-63559 · Severity: high · CVSS 7.5 · Published 2026-07-30

Executive brief

open62541 is an open-source implementation of the OPC UA industrial communication protocol used in manufacturing and automation. A flaw in how the software handles complex data structures could allow a remote attacker to read sensitive information from the system's memory. This could lead to the exposure of internal configuration data or other confidential information processed by the industrial control system.

Technical details

An integer overflow vulnerability exists in the open62541 library within the UA_Variant arrayDimensions product computation. The flaw occurs when multiplying attacker-controlled arrayDimensions values into a size_t accumulator without sufficient overflow checks, causing the product to wrap and match a smaller-than-expected arrayLength. A remote, unauthenticated attacker can exploit this during Variant binary decoding or encoding to trigger an out-of-bounds heap read. This can result in the disclosure of sensitive memory contents. The issue has been addressed in multiple branches (1.3, 1.4, 1.5, and master) by implementing checked multiplication at all sites where the dimension product is computed.

Affected products

  • o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch

Timeline

  • 2026-05-11: patched: Initial fix commits authored
  • 2026-07-23: patched: Fixes merged into 1.3 and 1.4 branches
  • 2026-07-24: patched: Fixes merged into 1.5 branch
  • 2026-07-30: advisory: NVD publication date

References