CVE-2026-18784: open62541 Buffer Overflow Vulnerability

CVE-2026-18784 Overview

CVE-2026-18784 is a heap-based buffer overflow [CWE-119] in the open62541 OPC UA implementation, affecting versions up to 1.5.5. The flaw resides in the UA_Client_readNodeClassAttribute function within src/client/ua_client_highlevel.c. An authenticated local attacker can manipulate input to corrupt heap memory in the client process. A public exploit has been disclosed. The open62541 project closed the associated issue report, indicating that the reporter did not follow the project's official security disclosure process.

Critical Impact
Local exploitation can corrupt heap memory in the open62541 client, potentially leading to process crash or limited memory disclosure. The CVSS 4.0 base score is 1.9 (Low).

Affected Products

open62541 open-source OPC UA stack, versions up to and including 1.5.5
Client applications linking src/client/ua_client_highlevel.c
Downstream industrial and IoT integrations embedding the open62541 client

Discovery Timeline

2026-08-04 - CVE-2026-18784 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18784

Vulnerability Analysis

The vulnerability affects UA_Client_readNodeClassAttribute, a helper function in the open62541 client's high-level API. This function issues a read request for the NodeClass attribute of an OPC UA node and copies the returned value into a caller-supplied buffer. The heap-based buffer overflow is triggered during handling of the returned attribute data, causing writes beyond the allocated heap region.

An attacker requires local access and low-privileged authentication to reach the vulnerable code path. Exploitation impacts confidentiality, integrity, and availability at a limited scope, according to the CVSS 4.0 vector. A public proof-of-concept exists, though the project maintainers have not confirmed the report through their official channel.

Root Cause

The root cause is insufficient bounds validation when the client processes the NodeClass attribute response and writes it into the destination buffer. The overflow falls under [CWE-119], Improper Restriction of Operations within the Bounds of a Memory Buffer. Refer to the open62541 issue #8139 and the reporter's write-up for further technical context.

Attack Vector

Exploitation is local and requires authentication. An attacker with the ability to influence the data returned to the UA_Client_readNodeClassAttribute call, for example by controlling a malicious OPC UA server the client connects to or by tampering with local IPC data, can trigger the overflow. See the VulDB report for CVE-2026-18784 for additional exploit metadata.

No verified exploitation code is available from an authoritative source. The mechanics are described in prose to avoid fabrication.

Detection Methods for CVE-2026-18784

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking the open62541 client library
Heap corruption signatures reported by AddressSanitizer or glibc heap checks in open62541-based applications
Client connections to unknown or untrusted OPC UA servers preceding client instability

Detection Strategies

Scan build manifests and software bills of materials for open62541 versions at or below 1.5.5
Run open62541 client binaries under AddressSanitizer during QA to surface heap-based overflows in UA_Client_readNodeClassAttribute
Monitor endpoint telemetry for repeated crashes of OPC UA client processes correlated with new outbound OPC UA sessions

Monitoring Recommendations

Log all outbound OPC UA client connections and alert on connections to servers outside an approved allowlist
Capture core dumps from industrial gateways using open62541 and review for heap corruption patterns
Track vendor and distribution advisories referencing open62541 through the VulDB vulnerability record

How to Mitigate CVE-2026-18784

Immediate Actions Required

Inventory all applications, gateways, and firmware images that embed the open62541 client library
Restrict open62541 client processes to connect only to trusted, authenticated OPC UA servers
Run open62541 clients under least-privilege service accounts to limit blast radius of a local exploit

Patch Information

No official fixed version has been published by the open62541 project at the time of this writing. The maintainers closed the referenced issue, stating that it was not filed through the project's official security disclosure channel. Track the open62541 GitHub repository for a coordinated fix and rebuild dependent applications once a patched release is available.

Workarounds

Avoid calling UA_Client_readNodeClassAttribute against untrusted servers until a patched release is available
Wrap client calls with input length validation on returned attribute buffers where source modification is feasible
Isolate OPC UA client hosts on segmented networks to reduce local access exposure

bash

# Configuration example: locate vulnerable open62541 versions on Linux hosts
find / -name 'libopen62541*' 2>/dev/null -exec strings {} \; | grep -i 'open62541.*1\.[0-5]\.'