Remote Null Pointer Dereference in open62541 Client Library
CVE-2026-15690

2.3LOW

Key Information:

Vendor: open62541
Status: Open62541
Vendor: CVE Published:; 14 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15690?

A vulnerability exists in the open62541 Shared Client Library, specifically within the responseReadNamespacesArray function of the file src/client/ua_client_connect.c. This flaw allows for a null pointer dereference, which can be caused by improper handling of the Server_NamespaceArray argument. Although the exploitation of this vulnerability is complex, it can be executed remotely, potentially affecting stability and leading to application failure. Despite the availability of public exploits, the open62541 project advises that this situation does not follow the official reporting protocol for security vulnerabilities.

Affected Version(s)

open62541 1.5.0

open62541 1.5.1

open62541 1.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15690 - Proof of Concept