CVE-2026-65423

The integer overflow in open62541's UA_Variant dimension handling (CVE-2026-65423) deserves attention not for its technical elegance but for its supply-chain blast radius. The mechanism is straightforward: multiplying array dimensions without overflow-safe arithmetic produces a wrapped small value, causing the library to allocate a buffer sized for the overflow result while accepting data sized for the original large dimensions — resulting in out-of-bounds write. What matters more is what consumes that corrupted data. The critical analytical distinction is read-mode versus write-mode. Most OPC UA deployments use the server path — open62541 aggregating data upward from PLCs to HMIs and historians. In this configuration, the overflow corrupts telemetry going into analytics and trend displays: data integrity failure, not control compromise. If your deployment uses the client path to push Variants back to controllers (tag writes, historian buffering), the blast radius inverts — this becomes a control injection vector. Check which direction your data flows; that determines whether this is a noisy-data problem or a control-integrity problem. The supply-chain reality compounds the risk in ways the CVSS score obscures. open62541 is embedded in commercial HMI software, data historians, and SCADA gateways from dozens of vendors who rarely expose their dependency chain. The EPSS score of 0.00605 reflects poor asset visibility rather than low exploitability — if your industrial network was breached through initial enterprise compromise, this library vulnerability determines whether the attacker can persist into the OT tier. The air-gap assumption is eroding; lateral movement from IT into OT is the realistic attack path, not internet scanning. Configuration matters enormously. Production builds frequently disable ASAN, UBSan, and bound checks for performance. If your vendor ships with these disabled, the overflow executes a viable exploitation path. If hardened compilation flags are enabled, the process may abort cleanly rather than proceeding to the OOB write. Ask your vendors specifically about their open62541 build configuration — the CVE record won't tell you which variant you run. Finally, recognize the patch adoption barrier. Industrial vendors lock library versions not from negligence but because updating transitive dependencies triggers IEC 62443 revalidation requirements. A vendor who pinned to open62541 1.3.x eighteen months ago during certification may be structurally unable to absorb a patch without invalidating their compliance posture. The patch exists; the deployment may not see it for 18-36 months. This means your defensive priority is network segmentation and lateral movement controls, not waiting for a vendor update that may not arrive in your operational window.

Reviewed through automated stages and approved by a human before publication.