VYPR
← All advisories
High severityNVD Advisory· Published Sep 14, 2018· Updated Aug 5, 2024

CVE-2018-12086

CVE-2018-12086

Description

Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A stack-based buffer overflow in OPC UA applications allows remote attackers to trigger a crash or arbitrary code execution via crafted requests.

Vulnerability

The vulnerability is a buffer overflow in OPC UA applications that allows remote attackers to trigger a stack overflow by sending carefully crafted requests. The official description does not specify a particular vendor or product, but GitHub Advisory Database [2] identifies the affected package as OPCFoundation.NetStandard.Opc.Ua on NuGet, with affected versions up to and including 1.4.352.12. The overflow occurs when handling structured OPC UA requests, leading to a stack buffer overflow.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted OPC UA requests over the network to a vulnerable application. No authentication is mentioned as a prerequisite, so the attack can likely be performed by an unauthenticated remote attacker. The overflow is triggered during request parsing or processing, without requiring user interaction.

Impact

Successful exploitation could allow an attacker to cause a denial of service via application crash (stack overflow) or potentially achieve arbitrary code execution on the affected system. The impact is high severity (CVSS base score 8.6, High) [2], indicating a significant risk of compromise.

Mitigation

The vulnerability is patched in version 1.4.353.15 of the OPCFoundation.NetStandard.Opc.Ua package [2]. Users should upgrade to this or a later version. An OpenSUSE security announcement [1] also provides a fix for affected distributions. No workarounds are described in the available references; if an upgrade is not immediately possible, network-level filtering or restrictions on OPC UA port access may reduce exposure.

References
  1. NVD - CVE-2018-12086
  2. CVE-2018-12086 - GitHub Advisory Database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
OPCFoundation.NetStandard.Opc.UaNuGet
< 1.4.353.151.4.353.15

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.