{"id":"CVE-2026-116014","summary":"open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType","details":"open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.","modified":"2026-10-25T07:13:36.410077550Z","published":"2026-10-24T11:40:32.200Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116014.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-190"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116014.json"},{"type":"PACKAGE","url":"https://github.com/open62541/open62541"},{"type":"ARTICLE","url":"https://github.com/open62541/open62541/blob/v1.5.6/src/ua_types_definition.c#L274"},{"type":"FIX","url":"https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec"},{"type":"FIX","url":"https://github.com/open62541/open62541/pull/8298"},{"type":"FIX","url":"https://github.com/open62541/open62541/pull/8302"},{"type":"ADVISORY","url":"https://github.com/open62541/open62541/releases/tag/v1.5.7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116014"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/open62541-1.5.0-before-1.5.7-integer-overflow-heap-buffer-overflow-via-custom-datatype"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open62541/open62541","events":[{"introduced":"b90fbfac5ef484089447bf5e3fe6ad7baaaebada"},{"fixed":"d1173ccc31560ffc60c29e24ce8adb19f8c3c686"},{"fixed":"0cf4806768c493bc6ccffcd4419da24153b970ec"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"1.5.0"},{"fixed":"1.5.7"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"0cf4806768c493bc6ccffcd4419da24153b970ec"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.5.7","range":[{"fixed":"d1173ccc31560ffc60c29e24ce8adb19f8c3c686"}],"source":"REFERENCES_TAG"}]}}],"versions":["v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116014.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"1258018962123245284819591511806126337","length":3980},"id":"CVE-2026-116014-1ca44fde","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec","target":{"function":"UA_DataType_fromStructureDescription","file":"src/ua_types_definition.c"}},{"digest":{"line_hashes":["241197372227142944158332867153798763454","38562436060311950809061039952520902662","316960096051453461929336873674490107843","234660736508028157029695293069982822056","301280855884949011644153419346695056212","297678954421009602281053474485324605618","101803710510512423838401463946968122426","154319255555571677342354935805317657655","311467771545637578054703709673035729588","29312936330875953524387491553174713962","233104898784197086948420641621931101954","295991854134806413868631519807331494693","22243407355950629405998268328535186522","263452517604098742177343401511788113497","52787700268827232352379654150552073890","87334269114095053873126884267894818672","82266690171063828689026089485800887801","8493231652334799671583443302112582770","95877341980676218492741257335119694974","63418533668127511187766472239167139650","60117823093219231903166884598312296018","248829986129784225678779217856340375242","272968765866547502169944910772467148911","427582995710491049843815519571299140","138688426270750020371041310629342333785","80960413183240660965561686130602714564","210544613369808086507411075937151244116","46166058041618993242273401061935021122","207387000271801539753203882609244180958","230119405611811991788674197736909624088","154037918297761306646343281012469862003","76201728998699036692580987943364593149","42517744921756069411955900234884221903"],"threshold":0.9},"id":"CVE-2026-116014-649d04c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec","target":{"file":"src/ua_types_definition.c"},"deprecated":false},{"digest":{"function_hash":"274021503777515861984971139865004562514","length":1335},"id":"CVE-2026-116014-caaadfb0","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec","target":{"file":"src/ua_types_definition.c","function":"UA_DataType_fromEnumDescription"},"deprecated":false}],"vanir_signatures_modified":"2026-10-25T07:13:36Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}