Open62541: Four Vulnerabilities Disclosed Together, Ranging Medium to High Severity
Four vulnerabilities in Open62541, disclosed on July 30, 2026, pose risks including DoS, info disclosure, and code execution.
Key findings
- Four vulnerabilities in Open62541 disclosed on July 30, 2026, including three integer overflows and one heap use-after-free.
- High-severity flaws could lead to sensitive information disclosure, denial of service, or arbitrary code execution.
- Affected versions include Open62541 1.3.x, 1.4.x, 1.5.x, and the master branch on Windows and Linux.
- CISA advisory ICSA-26-211-08 details the vulnerabilities and affected systems.
On July 30, 2026, a batch of four vulnerabilities was disclosed for the Open62541 communication library. These vulnerabilities, detailed in a CISA advisory, span a range of severity from medium to high, with potential impacts including denial of service, sensitive information disclosure, and arbitrary code execution. The disclosures highlight issues within Open62541's handling of PubSub messages and variant array dimensions.
Three of the vulnerabilities are related to integer overflows in the UA_Variant array dimension computation. CVE-2026-65423, a high-severity flaw, could lead to an out-of-bounds write. CVE-2026-63559, also high-severity, presents a risk of reading out-of-bounds heap memory, potentially exposing sensitive data. CVE-2026-63362, a medium-severity vulnerability, stems from an unsigned integer underflow in PubSub signature verification, which could result in a denial of service via a crafted UDP packet.
A separate high-severity vulnerability, CVE-2026-63035, affects the TransferSubscriptions service. This heap use-after-free flaw could allow an authenticated attacker to achieve denial of service or even execute arbitrary code.
According to CISA, successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of service, or potentially execute arbitrary code. The affected versions of Open62541 on Windows and Linux include:
- Versions from 1.3.0 up to and including 1.3.17
- Versions from 1.4.0 up to and including 1.4.16
- Versions from 1.5.0 up to and including 1.5.4
- The master branch
Users of Open62541 are advised to update to patched versions as soon as possible to mitigate these risks. The coordinated disclosure by CISA emphasizes the critical nature of these flaws within the Open62541 library, which is widely used in industrial control systems and IoT applications.
This batch of vulnerabilities underscores the importance of secure coding practices in communication libraries, particularly those handling complex data structures and network protocols. The potential for remote exploitation and code execution makes timely patching a priority for all users of affected Open62541 versions.
The CISA advisory (ICSA-26-211-08) provides further details on the vulnerabilities and affected systems. CISA ICS Advisories