CVE Feed

    Dashboard / CVE / CVE-2026-1301

    CVE-2026-1301

    In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.

    Published:Feb 5, 2026
    Last Modified:Apr 18, 2026
    EPS:Feb 5, 2026
    EPSS Score:0.00022
    CVSS Score:6.8

    Affected Products

    Vendor
    Open62541
    Product
    Open62541

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-82623 (CVSS 5.5) — A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataV…
    CVE-2026-67863 (CVSS 7.5) — In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue oc…
    CVE-2026-67870 (CVSS 9.8) — In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for n…
    CVE-2026-67869 (CVSS 7.5) — Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via th…
    CVE-2026-67864 (CVSS 7.5) — An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeMan…
    CVE-2026-18785 (CVSS 1.9) — A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the funct…
    CVE-2026-18784 (CVSS 1.9) — A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClass…
    CVE-2026-67860 (CVSS 7.5) — open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history…
    CVE-2026-67862 (CVSS 7.5) — open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_h…
    CVE-2026-67858 (CVSS 7.5) — Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with mu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High