GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63559 (GCVE-0-2026-63559)

Vulnerability from cvelistv5 – Published: 2026-07-30 21:47 – Updated: 2026-08-25 14:22
VLAI
Title
o6 Automation open62541 Integer Overflow or Wraparound
Summary
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 15:42 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
o6 Automation open62541 Affected: 1.3.0 , ≤ 1.3.17 (custom)
Affected: 1.4.0 , ≤ 1.4.16 (custom)
Affected: 1.5.0 , ≤ 1.5.4 (custom)
Affected: master
guessed Create a notification for this product.
Credits
Asher Davila and Malav Vyas of Palo Alto Networks reported this vulnerability to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63559",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T15:42:25.786250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T15:42:40.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "open62541",
          "vendor": "o6 Automation",
          "versions": [
            {
              "lessThanOrEqual": "1.3.17",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.4.16",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.5.4",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "master"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asher Davila and Malav Vyas of Palo Alto Networks reported this vulnerability to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer overflow in the UA_Variant arrayDimensions product \ncomputation in open62541 may allow a remote attacker to read \nout-of-bounds heap memory, potentially disclosing sensitive information."
            }
          ],
          "value": "An integer overflow in the UA_Variant arrayDimensions product \ncomputation in open62541 may allow a remote attacker to read \nout-of-bounds heap memory, potentially disclosing sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T14:22:58.350Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.o6-automation.com/contact"
        },
        {
          "url": "https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f"
        },
        {
          "url": "https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60"
        },
        {
          "url": "https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e"
        },
        {
          "url": "https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eo6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u0026nbsp;\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\nor by downloading from the \nfollowing locations:\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\"\u003ehttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\"\u003ehttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\"\u003ehttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\u003c/a\u003e\u003cbr\u003e\u003ca href=\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\"\u003ehttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u0026nbsp;\u003ca href=\"https://www.o6-automation.com/contact\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "o6 Automation has prepared mitigations and fixes to address these \nissues and recommends that users update to the newest version. The new \nversion can be obtained by contacting o6 Automation\u00a0\u00a0 https://www.o6-automation.com/contact \nor by downloading from the \nfollowing locations:\n https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f \n https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 \n https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e \n https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df \n\n\n\n\nFor more information, see open62541 \nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \ncontact o6 Automation:\u00a0 https://www.o6-automation.com/contact"
        }
      ],
      "source": {
        "advisory": "ICSA-26-211-08",
        "discovery": "EXTERNAL"
      },
      "title": "o6 Automation open62541 Integer Overflow or Wraparound",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2026-63559",
    "datePublished": "2026-07-30T21:47:21.231Z",
    "dateReserved": "2026-07-27T15:02:47.789Z",
    "dateUpdated": "2026-08-25T14:22:58.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63559",
      "date": "2026-09-16",
      "epss": "0.00434",
      "percentile": "0.36975"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63559\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2026-07-30T22:16:55.717\",\"lastModified\":\"2026-09-03T18:04:16.263\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An integer overflow in the UA_Variant arrayDimensions product \\ncomputation in open62541 may allow a remote attacker to read \\nout-of-bounds heap memory, potentially disclosing sensitive information.\"}],\"affected\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"affectedData\":[{\"vendor\":\"o6 Automation\",\"product\":\"open62541\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Windows\",\"Linux\"],\"versions\":[{\"version\":\"1.3.0\",\"lessThanOrEqual\":\"1.3.17\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.0\",\"lessThanOrEqual\":\"1.4.16\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.5.0\",\"lessThanOrEqual\":\"1.5.4\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"master\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-31T15:42:25.786250Z\",\"id\":\"CVE-2026-63559\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.o6-automation.com/contact\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-07-31T14:58:30+00:00",
      "cve": "CVE-2026-63559",
      "id": "CVE-2026-63559",
      "initial_release_date": "2026-07-30T21:47:21.231000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "open62541: open62541: Information disclosure via integer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63559.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63559\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-31T15:42:25.786250Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-31T15:42:34.498Z\"}}], \"cna\": {\"title\": \"o6 Automation open62541 Integer Overflow or Wraparound\", \"source\": {\"advisory\": \"ICSA-26-211-08\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Asher Davila and Malav Vyas of Palo Alto Networks reported this vulnerability to CISA.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"o6 Automation\", \"product\": \"open62541\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.3.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.3.17\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.4.16\"}, {\"status\": \"affected\", \"version\": \"1.5.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.5.4\"}, {\"status\": \"affected\", \"version\": \"master\"}], \"platforms\": [\"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"o6 Automation has prepared mitigations and fixes to address these \\nissues and recommends that users update to the newest version. The new \\nversion can be obtained by contacting o6 Automation\\u00a0\\u00a0 https://www.o6-automation.com/contact \\nor by downloading from the \\nfollowing locations:\\n https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f \\n https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 \\n https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e \\n https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df \\n\\n\\n\\n\\nFor more information, see open62541 \\nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \\ncontact o6 Automation:\\u00a0 https://www.o6-automation.com/contact\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eo6 Automation has prepared mitigations and fixes to address these \\nissues and recommends that users update to the newest version. The new \\nversion can be obtained by contacting o6 Automation\u0026nbsp;\u0026nbsp;\u003ca href=\\\"https://www.o6-automation.com/contact\\\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\\nor by downloading from the \\nfollowing locations:\u003cbr\u003e\u003ca href=\\\"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\\\"\u003ehttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\u003c/a\u003e\u003cbr\u003e\u003ca href=\\\"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\\\"\u003ehttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\u003c/a\u003e\u003cbr\u003e\u003ca href=\\\"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\\\"\u003ehttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\u003c/a\u003e\u003cbr\u003e\u003ca href=\\\"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\\\"\u003ehttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\u003c/a\u003e\u003c/p\u003e\\n\u003cp\u003eFor more information, see open62541 \\nSecurity Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or \\ncontact o6 Automation:\u0026nbsp;\u003ca href=\\\"https://www.o6-automation.com/contact\\\"\u003ehttps://www.o6-automation.com/contact\u003c/a\u003e\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.o6-automation.com/contact\"}, {\"url\": \"https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f\"}, {\"url\": \"https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60\"}, {\"url\": \"https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e\"}, {\"url\": \"https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df\"}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08\"}, {\"url\": \"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An integer overflow in the UA_Variant arrayDimensions product \\ncomputation in open62541 may allow a remote attacker to read \\nout-of-bounds heap memory, potentially disclosing sensitive information.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An integer overflow in the UA_Variant arrayDimensions product \\ncomputation in open62541 may allow a remote attacker to read \\nout-of-bounds heap memory, potentially disclosing sensitive information.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2026-08-25T14:22:58.350Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-63559\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T14:22:58.350Z\", \"dateReserved\": \"2026-07-27T15:02:47.789Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2026-07-30T21:47:21.231Z\", \"assignerShortName\": \"icscert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.