Medium severity · published Aug 4, 2026
CVE-2026-18785
o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
open62541 · o6
ca356b088ada7dee824d1b4acd07c1ff07ce242b · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18785
github.com
https://github.com/gff-cw/information/issues/12
github.com
https://github.com/open62541/open62541/issues/8131
vuldb.com
https://vuldb.com/cve/CVE-2026-18785
vuldb.com
https://vuldb.com/submit/857052
vuldb.com
https://vuldb.com/vuln/385787
vuldb.com
https://vuldb.com/vuln/385787/cti
More from open62541
8.1
CVE-2026-116014
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
7.5
CVE-2024-53429
Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash
7.5
CVE-2022-25761
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks…
5.5
CVE-2020-36429
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth
5.3
CVE-2026-82623
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free