Four flaws in open62541 OPC UA hit critical infra stacks

The headline number is CVE-2026-65423: an integer overflow in the UA_Variant arrayDimensions product computation that carries an 8.8 CVSS v3 base score and permits an authenticated remote attacker to achieve full confidentiality, integrity, and availability impact. That's code execution territory on a library embedded across critical manufacturing, energy, and transportation stacks.

The other three are worth mapping: CVE-2026-63362 is an unsigned integer underflow in the PubSub signature verification path triggered by a crafted UDP packet (CVSS 8.2 v4, no authentication required, but high attack complexity pulls the v3 score down to 5.9); CVE-2026-63035 is a heap use-after-free in the TransferSubscriptions service requiring authentication but scoring 8.1 v3 with high integrity and availability impact; CVE-2026-63559 is a second integer overflow in the arrayDimensions computation that allows out-of-bounds heap reads, potentially disclosing sensitive information.

All four affect the full range from 1.3.0 through 1.5.4, plus the master branch on both Windows and Linux. That's a wide surface: open62541 is the dominant open-source OPC UA implementation, and OPC UA is the interoperability backbone for industrial control systems globally.

The remediation gap

o6 Automation's advisory language is standard but imprecise: "o6 Automation has prepared mitigations and fixes" and "recommends that users update to the newest version." The commit links to GitHub pull requests 8235, 8238 are live, so the patches exist in source. But no version tag, release number, or availability date is specified. The advisory directs users to contact o6 Automation directly for the new version.

For a defense contractor or energy operator running open62541 in production, "contact the vendor for the patched build" is a scheduling problem. It means the security team can't independently verify whether the fix is available, can't automate the pull, and can't plan a maintenance window without a phone call or email exchange. In operational terms, the patch is real but the distribution is bottlenecked.

The CWE assignments (integer underflow (CWE-191), integer overflow or wraparound (CWE-190), use-after-free (CWE-416)) are textbook memory-safety bug classes. None of these is an exotic protocol-level weakness. They're implementation defects in arithmetic and lifecycle management that static analysis tooling could flag. The fact that four such flaws ship simultaneously across the entire supported version range suggests a library that hasn't had systematic memory-safety auditing across its attack surface.

Practitioner Monday

If you run open62541 in OT environments, Monday's task is: isolate the version you're on (1.3.x, 1.4.x, 1.5.x, or master), assess network exposure for each deployment, and contact o6 Automation for the patch if you haven't already. For 1.3.x shops in particular, version 1.3.17 is the stated ceiling and there's no implicit upgrade path to 1.5, confirm whether backported fixes exist or whether a version jump is the only route. If the vendor can't supply a patched build within your remediation window, network segmentation and PubSub/JSON feature disabling where feasible are the fallbacks until the release formalizes.