External risk intelligence

open62541 Integer Overflow in DataType Decoding Allows Heap Corruption

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-116014

The vulnerability affects the open62541 OPC UA client implementation. While OPC UA is a network protocol, it is primarily used in industrial automation and internal operational technology environments. Direct exposure of OPC UA clients to the public internet is uncommon, as these systems are typically deployed within private, segmented industrial networks.

Integer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the open62541 library, which is used for OPC UA communication. This issue, specifically an integer overflow, could allow a malicious server to compromise client systems that process custom data structures. The primary concern is confirming whether our environment utilizes this specific library and is exposed to such a threat.

Integer overflow in data processing.
Affects systems using open62541 OPC UA.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by interacting with an OPC UA client that is connected to a malicious OPC UA server. The server can then send specially crafted data definitions to the client. This data, when processed by the client's `decodeBinaryStructure` function, triggers an integer overflow in the `memSize` field. This overflow can lead to a heap buffer overflow, potentially allowing the attacker to crash the client or execute arbitrary code.

Requires a malicious OPC UA server.
Triggered by custom data type definitions.
Risk: Client crash or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the behavior and stability of OPC UA clients when interacting with specially crafted data type definitions from untrusted servers. Under certain conditions, this could lead to a client crash or potentially allow for code execution.

Client stability and data processing.
Malicious server supplies crafted DataType definitions.
Client crash or potential code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects open62541, a popular OPC UA implementation. Given its use in industrial control systems and operational technology, ownership likely resides with OT infrastructure teams or the specific application teams managing these environments. The initial step should be to identify all instances of the affected technology, assess their network exposure and business criticality, and then engage the accountable owner to plan remediation based on risk and operational schedules.

Confirm affected technology deployment.
Verify network exposure and criticality.
Plan remediation with asset owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is open62541 and how is it used?

open62541 is an open-source library that implements the OPC Unified Architecture (OPC UA) standard. It is primarily used by developers to build OPC UA clients and servers that facilitate secure, reliable data exchange in industrial automation, robotics, and complex operational technology (OT) environments.

What does CWE-190 mean for CVE-2026-116014?

CWE-190 refers to an Integer Overflow weakness. In this vulnerability, the software calculates a memory size value that exceeds what a 16-bit field can hold, causing it to wrap around to a smaller number. This error leads the system to allocate insufficient memory for incoming data, resulting in a heap buffer overflow that can destabilize the client.

How is this heap overflow triggered?

An attacker triggers this by acting as a malicious OPC UA server. When a vulnerable client connects and requests custom data type definitions, the server sends a specially crafted response. The flaw occurs during the client's decoding process; standard, valid data type definitions that do not manipulate the memory size field do not trigger this vulnerability.

Do I need to worry if my system is internal?

Halo Surface Signal indicates that while the vulnerability is network-based, it is unlikely to impact the public internet. OPC UA clients typically operate within private, segmented industrial networks. You should prioritize internal systems that connect to untrusted or third-party servers, as these pose a higher risk than fully isolated components.

How should I respond to this threat?

First, conduct an inventory to identify if your software stack includes open62541 versions between 1.5.0 and 1.5.6. Once identified, evaluate the specific connectivity requirements of those clients. Coordinate with your OT or application teams to update the library to version 1.5.7 or later to patch the decoding logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.