Is CVE-2026-65423 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65423 being exploited in the wild.

How severe is CVE-2026-65423?

High severity, with a CVSS score of 8.8, published 30 July 2026.

Which products and versions are affected?

o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch.

Is there a fix for CVE-2026-65423?

A patch was published on 2026-05-11: Initial fix commits authored. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65423 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65423?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65423: o6 Automation open62541 integer overflow in UA_Variant arrayDimensions

CVE-2026-65423 · Severity: high · CVSS 8.8 · Published 2026-07-30

open62541 is an open-source implementation of OPC UA, a communication protocol used extensively in industrial automation and Internet of Things (IoT) environments. A vulnerability has been identified where the software incorrectly calculates memory requirements when processing complex data structures. An attacker could exploit this to gain unauthorized access to sensitive information, modify system data, or cause the software to crash, potentially disrupting industrial operations.

Quick answers

Is CVE-2026-65423 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65423 being exploited in the wild.
How severe is CVE-2026-65423?: High severity, with a CVSS score of 8.8, published 30 July 2026.
Which products and versions are affected?: o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch.
Is there a fix for CVE-2026-65423?: A patch was published on 2026-05-11: Initial fix commits authored. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65423 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65423?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in open62541 within the UA_Variant arrayDimensions product computation. The flaw occurs when multiplying attacker-controlled arrayDimensions values into a size_t accumulator without sufficient overflow checks, causing the product to wrap and match a smaller-than-expected arrayLength. A remote attacker with low privileges can exploit this during Variant binary encoding or decoding to trigger an out-of-bounds write or read. This can lead to memory corruption, information disclosure, or a denial-of-service condition. Patches have been developed for versions 1.3, 1.4, 1.5, and the master branch.

Affected products

o6 Automation open62541 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch

Timeline

2026-05-11: patched: Initial fix commits authored.
2026-07-23: patched: Fixes merged into main branches.
2026-07-30: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.