A critical integer overflow vulnerability in open62541 can lead to memory corruption, posing a significant risk of remote code execution or system instability.

This vulnerability is an integer overflow (CWE-190) occurring within the UA_Variant arrayDimensions computation. It requires low privileges to execute and allows a remote attacker to perform an out of bounds write, which could be leveraged to compromise the host system.

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for significant impact to confidentiality, integrity, and availability. Successful exploitation may result in unauthorized system access, data loss, or the complete compromise of devices running the affected automation software, potentially disrupting critical industrial operations.

Immediate Action: Users should update to the latest version of open62541 by contacting o6 Automation directly or pulling the latest source code fixes provided in the referenced GitHub commits.

Proactive Monitoring: Monitor device logs for unusual crash patterns or unexpected memory allocation errors that may indicate exploitation attempts.

Compensating Controls: Implement network segmentation to restrict access to the affected automation services and ensure they are not exposed to untrusted networks.

Public Exploit Available: Unknown.

Given the high CVSS score and the critical nature of industrial automation software, organizations should prioritize patching these systems during the next maintenance window. Apply the provided vendor source code fixes immediately to remediate the underlying memory corruption risk.