Buffer overflow in O6 Open62541
CVE-2026-18785
A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.002 (5.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- O6 Open62541 — versions ca356b088ada7dee824d1b4acd07c1ff07ce242b
Weakness classification (CWE)
References
- github.com/gff-cw/information/issues/12 (issue-tracking, exploit)
- github.com/open62541/open62541/issues/8131 (issue-tracking)
- vuldb.com/cve/CVE-2026-18785 (third-party-advisory)
- vuldb.com/submit/857052 (third-party-advisory)
- vuldb.com/vuln/385787 (technical-description, vdb-entry)
- vuldb.com/vuln/385787/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-18785?
- CVE-2026-18785 is a medium-severity vulnerability in O6 Open62541, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 5.3/10. Published 2026-08-04.
- How severe is CVE-2026-18785?
- Medium severity. CVSS v3 base score is 5.3 out of 10.