Bug 2560284 (CVE-2026-116014)

Summary: CVE-2026-116014 open62541: open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in open62541. This vulnerability allows a malicious Open Platform Communications Unified Architecture (OPC UA) server to trigger arbitrary code execution or a Denial of Service (DoS) on connecting client applications. By supplying specially crafted, oversized custom data type definitions, the server induces an integer overflow during decoding that results in a heap-based buffer overflow.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-24 11:51:44 UTC 
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.