Heap Overflow Vulnerability in PubSub JSON Decoder for Affected Vendor Products
CVE-2026-1301

6.8MEDIUM

Key Information:

Vendor

O6 Automation Gmbh

Status
Open62541
Vendor
CVE Published:
5 February 2026

What is CVE-2026-1301?

In certain builds that have PubSub and JSON functionality enabled, a specially crafted JSON message can exploit a vulnerability in the decoder, resulting in writing beyond a heap-allocated array. This process leads to a crash and potential memory corruption, which may expose systems to unauthorized access or disruptions. It is crucial for users and administrators to address this vulnerability to protect their systems and ensure data integrity.

Affected Version(s)

Open62541 1.5-rc1 < 1.5-rc2

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
government-resource

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Fasano of NIST CAISI reported this vulnerability to CISA.
.