o6 Automation open62541: 4 CVEs, High 8.8
Summary
CISA reports 4 vulnerabilities in o6 Automation GmbH open62541 on Windows and Linux. Weakness types: Integer Underflow (Wrap or Wraparound), Integer Overflow or Wraparound, Use After Free. Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of service, or potentially execute arbitrary code. Highest CVSS v3 score: 8.8 (High), exploitable over the network.
At a glance
- Vendor
- o6 Automation GmbH
- Products
- open62541 on Windows and Linux
- CVEs
- CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, CVE-2026-63559
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-63362 | Integer Underflow (Wrap or Wraparound) | 5.9 | – | No | An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet. |
| CVE-2026-65423 | Integer Overflow or Wraparound | 8.8 | – | No | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. |
| CVE-2026-63035 | Use After Free | 8.1 | – | No | A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code. |
| CVE-2026-63559 | Integer Overflow or Wraparound | 7.5 | – | No | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. |
Affected products (4)
- o6 Automation GmbH open62541 on Windows and Linux: >=from_1.3.0|<=1.3.17
- o6 Automation GmbH open62541 on Windows and Linux: >=from_1.4.0|<=1.4.16
- o6 Automation GmbH open62541 on Windows and Linux: >=from_1.5.0|<=1.5.4
- o6 Automation GmbH open62541 on Windows and Linux: master
Vendor fixes and mitigations (from advisory)
- Mitigation: o6 Automation has prepared mitigations and fixes to address these issues and recommends that users update to the newest version. The new version can be obtained by contacting o6 Automation https://www.o6-automation.com/contact or by downloading from the following locations: link
- Mitigation: https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f link
- Mitigation: https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 link
- Mitigation: https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e link
- Mitigation: https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df link
- Mitigation: For more information, see open62541 Security Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or contact o6 Automation: https://www.o6-automation.com/contact link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.