Low severity · published Jul 14, 2026
CVE-2026-15690
open62541 Shared Client ua_client_connect.c responseReadNamespacesArray null pointer dereference
3.1
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argument Server_NamespaceArray leads to null pointer dereference. The attack can be executed remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit is publicly available and might be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
open62541 · Open62541
1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5 · source: vendor
Affected product
OP
open62541
Open62541
More from open62541
8.1
CVE-2026-116014
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
7.5
CVE-2024-53429
Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash
7.5
CVE-2022-25761
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks…
5.5
CVE-2020-36429
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth
5.3
CVE-2026-82623
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free