Description
In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| o6 Automation | Open62541 | 1.5-rc1 – < 1.5-rc2 | 1.5-rc2 |
Advisories 1
- ICSA-26-036-03 o6 Automation GmbH Open62541 CISA ICS & IT advisories · Feb 5, 2026
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-036-03 government-resource