CVE-2026-63559
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds h
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Jul 30, 2026 · Last modified: Jul 30, 2026 · CWE-190
Not enough EPSS history yet.
An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information.
- github.comhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json
- github.comhttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f
- github.comhttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60
- github.comhttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e
- github.comhttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df
- www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08
- www.o6-automation.comhttps://www.o6-automation.com/contact
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-654238.8 HIG—
———An integer overflow in the UA_Variant arrayDimensions product
computation in open62541 may allow a remote attacker to trigger an
out-of-bounds write.7hCVE-2026-165297.5 HIG—
——0A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.16hCVE-2026-177269.6 CRI—
——0Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)9hCVE-2026-177179.6 CRI—
——0Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)10hCVE-2026-177058.8 HIG—
——0Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)13hCVE-2026-176829.6 CRI—
——0Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)13h