CVE-2026-116014

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116014
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116014.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-116014
Downstream
Published
2026-10-24T11:40:32Z
Modified
2026-10-25T07:13:36Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
Details

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116014.json"
}
References

Affected packages

Git / github.com/open62541/open62541

Affected ranges

Type
GIT
Repo
https://github.com/open62541/open62541
Events
Introduced
b90fbfac5ef484089447bf5e3fe6ad7baaaebada
Fixed
d1173ccc31560ffc60c29e24ce8adb19f8c3c686
Fixed
0cf4806768c493bc6ccffcd4419da24153b970ec
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "fixed": "1.5.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "0cf4806768c493bc6ccffcd4419da24153b970ec"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.5.7",
            "range": [
                {
                    "fixed": "d1173ccc31560ffc60c29e24ce8adb19f8c3c686"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116014.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "1258018962123245284819591511806126337",
            "length": 3980
        },
        "id": "CVE-2026-116014-1ca44fde",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec",
        "target": {
            "file": "src/ua_types_definition.c",
            "function": "UA_DataType_fromStructureDescription"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "241197372227142944158332867153798763454",
                "38562436060311950809061039952520902662",
                "316960096051453461929336873674490107843",
                "234660736508028157029695293069982822056",
                "301280855884949011644153419346695056212",
                "297678954421009602281053474485324605618",
                "101803710510512423838401463946968122426",
                "154319255555571677342354935805317657655",
                "311467771545637578054703709673035729588",
                "29312936330875953524387491553174713962",
                "233104898784197086948420641621931101954",
                "295991854134806413868631519807331494693",
                "22243407355950629405998268328535186522",
                "263452517604098742177343401511788113497",
                "52787700268827232352379654150552073890",
                "87334269114095053873126884267894818672",
                "82266690171063828689026089485800887801",
                "8493231652334799671583443302112582770",
                "95877341980676218492741257335119694974",
                "63418533668127511187766472239167139650",
                "60117823093219231903166884598312296018",
                "248829986129784225678779217856340375242",
                "272968765866547502169944910772467148911",
                "427582995710491049843815519571299140",
                "138688426270750020371041310629342333785",
                "80960413183240660965561686130602714564",
                "210544613369808086507411075937151244116",
                "46166058041618993242273401061935021122",
                "207387000271801539753203882609244180958",
                "230119405611811991788674197736909624088",
                "154037918297761306646343281012469862003",
                "76201728998699036692580987943364593149",
                "42517744921756069411955900234884221903"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116014-649d04c1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec",
        "target": {
            "file": "src/ua_types_definition.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "274021503777515861984971139865004562514",
            "length": 1335
        },
        "id": "CVE-2026-116014-caaadfb0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec",
        "target": {
            "file": "src/ua_types_definition.c",
            "function": "UA_DataType_fromEnumDescription"
        }
    }
]
vanir_signatures_modified 
"2026-10-25T07:13:36Z"