CVE-2026-1301: o6 Automation GmbH OPEN62541

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.

Affected products

• o6 Automation GmbH OPEN62541: from 1.5-rc1, before 1.5-rc2 (fixed in 1.5-rc2)

Published 2026-02-05. Last modified 2026-06-17.