PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1301 o6 Automation GmbH CVE debrief

CISA’s CSAF advisory for Open62541 says that, in builds with PubSub and JSON enabled, a crafted JSON message can make the decoder write beyond a heap-allocated array before authentication. The result is a reliable process crash and memory corruption risk. CISA assigns CVSS v3.1 5.7 (MEDIUM) and recommends upgrading to stable release v1.5.0.

Vendor
o6 Automation GmbH
Product
Open62541
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-05
Original CVE updated
2026-02-05
Advisory published
2026-02-05
Advisory updated
2026-02-05

Who should care

Organizations running Open62541 in OT/ICS environments, especially deployments with PubSub and JSON enabled; system integrators; platform maintainers; and incident responders supporting exposed or network-reachable installations.

Technical summary

The advisory describes a heap write beyond bounds in the JSON decoder path of Open62541 when PubSub and JSON are enabled. A crafted JSON message can trigger the issue before authentication, causing denial of service through process crash and creating a memory-corruption condition. The supplied CVSS vector is AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H, indicating network reachability with a required interaction condition and high availability impact.

Defensive priority

High for exposed or actively used deployments; Medium overall based on the published CVSS score.

Recommended defensive actions

  • Upgrade Open62541 to the stable release of v1.5.0 as recommended by the vendor.
  • Inventory deployments to identify systems built with PubSub and JSON enabled.
  • Prioritize remediation for any deployment that can receive untrusted JSON over the network.
  • Apply CISA ICS recommended practices and defense-in-depth controls to reduce exposure around affected services.
  • Monitor affected environments for unexpected process crashes, decoder faults, or other memory-corruption symptoms.

Evidence notes

All substantive claims here come from the CISA CSAF advisory ICSA-26-036-03 and its linked CVE record for CVE-2026-1301. The advisory states the affected configuration (PubSub plus JSON enabled), the pre-authentication crafted JSON trigger, the crash/memory-corruption impact, the CVSS v3.1 vector, and the vendor remediation to upgrade to stable v1.5.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-1301 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-1301

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-1301 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-1301

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-036-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-036-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.