Skip to content
eastbaycyber

CVE-2026-67863: open62541 server-side use-after-free denial of service

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-08-06
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - High-severity DoS flaw in open62541 1.5.5. - Affects servers using the vulnerable local MonitoredItem callback path. - Upgrade as soon as a fixed release is confirmed; no active exploitation is confirmed.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-67863
CVSS score 7.5 (High)
Attack vector Remote, via server-side subscription and local MonitoredItem callback path
Auth required Unknown from currently retrieved primary-source data; defenders should not assume authentication is a reliable barrier
Patch available Unknown from retrieved primary-source references
Affected version(s) open62541 1.5.5
Fixed version Not confirmed from currently retrieved primary sources
Impact Denial of service
Exploitation in the wild Not confirmed
Public PoC Not confirmed

The most important operational fact is that this is a server-side memory-safety bug in open62541 1.5.5. According to the NVD description, the flaw occurs in the local MonitoredItem callback path when UA_Subscription_localPublish continues using a UA_Notification after a callback deletes the current local MonitoredItem. The documented impact is remote denial of service.

For defenders, the uncertainty matters as much as the confirmed details. The affected version is clearly identified as 1.5.5, but the CVSS vector string, authentication requirements, and fixed version number were not confirmed in the source material provided. In practice, organizations running open62541-based OPC UA servers should treat exposed or remotely reachable deployments as higher risk until the project explicitly publishes remediation guidance.

What Is This Vulnerability?

CVE-2026-67863 is a use-after-free vulnerability. In plain terms, the software continues to use an object in memory after that object has already been freed. In C-based systems software, this bug class commonly leads to process instability, segmentation faults, aborted execution, or undefined behavior. In this case, the NVD description states that the practical outcome is denial of service, not confirmed code execution.

The root cause centers on re-entrant state mutation during callback processing. The vulnerable sequence described by NVD is specific: UA_Subscription_localPublish is processing the current UA_Notification, a callback runs, that callback calls UA_Server_deleteMonitoredItem for the current local MonitoredItem, and execution then continues with a now-invalid notification object. That means the software’s notification lifecycle handling does not safely account for object deletion occurring in the middle of the publish path.

Technical Notes

The affected code area identified in the available references includes:

  • src/server/ua_subscription.c
  • src/server/ua_services_monitoreditem.c
  • include/open62541/server.h

The technical pattern can be summarized like this:

/* Simplified conceptual flow, not vendor code */
current = currentNotification;
invoke_callback(current);

if(callback_deleted_current_monitored_item) {
    /* current or related structures may now be freed */
}

use(current); /* stale pointer / use-after-free */

From a practitioner standpoint, this matters because callback-driven logic is often harder to reason about than simple request parsing. If your application embeds open62541 and uses local callbacks for MonitoredItems, the vulnerable state may be reachable during normal subscription activity triggered by a remote client.

AnalystImpact · assess the risk

Who Is Affected?

The only version explicitly confirmed as affected in the currently available primary-source material is open62541 1.5.5. The NVD entry identifies open62541 1.5.5 directly, and no broader affected version range was confirmed in the supplied research. Because of that, it would be inaccurate to claim that earlier or later versions are also vulnerable unless the project later publishes an advisory stating so.

Organizations should focus on any product, appliance, gateway, or custom application embedding open62541 1.5.5 in server mode, especially if it exposes OPC UA services to untrusted or semi-trusted networks. This includes industrial and automation environments where OPC UA is used for telemetry, control integration, and monitoring. Even if the bug “only” causes denial of service, server crashes in these environments can interrupt production workflows, supervisory visibility, or operational coordination.

A practical challenge is software bill of materials visibility. Many operators will not know immediately whether a vendor appliance includes open62541 1.5.5. If you run an OT product or edge application that embeds OPC UA server functionality, check release notes, package manifests, container contents, or vendor statements for open62541 usage. If your vendor has not yet addressed CVE-2026-67863, assume exposure is possible until proven otherwise.

Technical Notes

Examples of where to verify open62541 presence:

# Linux package inventory
dpkg -l | grep -i open62541
rpm -qa | grep -i open62541

# Search application directories for linked libraries
find / -type f \( -name "*open62541*" -o -name "*.so*" \) 2>/dev/null

# Check container images
docker run --rm <image> sh -c 'find / -iname "*open62541*" 2>/dev/null'

If you build from source, inspect lockfiles, submodules, or vendored source trees:

grep -R "open62541" . 2>/dev/null
git submodule status

CVSS Score Breakdown

The reported CVSS score is 7.5, which places this vulnerability in the High severity range. However, the full CVSS vector string was not available in the supplied NVD tool output, so defenders should avoid over-interpreting specific metric components that have not been published in the retrieved materials.

Even without the vector string, the severity is consistent with a remotely reachable denial-of-service bug in server software. A use-after-free that can crash an OPC UA server has meaningful operational consequences, particularly in industrial networks where uptime matters. Availability loss alone can justify urgent remediation when the affected service is business-critical or safety-adjacent.

Because the vector is not confirmed, fields like Privileges Required, User Interaction, or exact Attack Complexity should be treated as unknown in this article. In the absence of authoritative data, defenders should assume the safest posture: if an external client can influence the vulnerable callback and notification processing path, segmentation and exposure reduction are prudent while waiting for a confirmed patch path.

A reasonable interpretation of the 7.5 score is that the flaw is serious enough to prioritize, but not yet escalated by public evidence of widespread exploitation. That means patching and compensating controls should be scheduled with urgency, particularly for internet-exposed or cross-zone reachable OPC UA servers, but there is no evidence here to justify panic claims.

Exploitation Status

At the time of writing, active exploitation in the wild is not confirmed. The supplied research specifically notes that CVE-2026-67863 is not listed in the CISA Known Exploited Vulnerabilities catalog, which means there is no CISA-backed indication of confirmed in-the-wild exploitation from that source.

Likewise, no public proof-of-concept exploit was confirmed in the retrieved source set. That does not mean exploitation is impossible or unlikely. It means only that, based on the available evidence in this research set, there is no confirmed public exploit artifact and no confirmed active exploitation to cite. Security teams should be careful not to confuse “no confirmed exploitation” with “no practical risk,” especially for memory-safety flaws in exposed server software.

The absence of a PoC slightly reduces near-term opportunistic risk, but targeted or private exploit development remains possible. Because the bug condition is described with specific function names and a clear trigger sequence, capable researchers or attackers may be able to reproduce it. Defenders should therefore act based on the impact and exposure, not on the current absence of public exploit chatter.

ResponderRunbook · act now

How to Detect It

Detection for this CVE is mainly about spotting service crashes, unexpected restarts, and suspicious subscription or MonitoredItem activity preceding the failure. Since the confirmed impact is denial of service, you should expect indicators such as process termination, segmentation fault logs, watchdog restarts, or sudden loss of OPC UA server availability.

If you operate open62541-based services, start by reviewing system logs around any unexplained crashes. Look for evidence that the OPC UA server process exited unexpectedly during periods of client subscription activity. Because the public documentation currently ties the bug to the local MonitoredItem callback path, environments with heavy subscription churn or application-specific callback logic deserve closer scrutiny.

Technical Notes

Concrete Linux log patterns to hunt for:

# systemd service failures
journalctl -u <your-opcua-service> --since "7 days ago" | egrep -i "segfault|signal 11|core dumped|aborted|failed|restart"

# kernel crash indicators
journalctl -k --since "7 days ago" | egrep -i "segfault|general protection|invalid pointer|double free|use after free"
dmesg | egrep -i "segfault|general protection|invalid pointer"

Example crash-focused detection query for centralized logging:

(service.name:"opcua" OR process.name:"opcua" OR process.command_line:*open62541*)
AND (
  message:*segfault* OR
  message:*signal 11* OR
  message:*core dumped* OR
  message:*invalid pointer* OR
  message:*aborted*
)

Network-side detection is less precise because the vulnerable condition is tied to application behavior, not a published byte signature. Still, defenders can flag unusual OPC UA activity on TCP/4840 preceding crashes:

alert tcp any any -> $HOME_NET 4840 (
  msg:"OPC UA server instability triage - client activity to TCP/4840";
  flow:to_server,established;
  sid:6786301;
  rev:1;
)

That signature is not a vulnerability detector. It is a triage aid to correlate inbound OPC UA traffic with server outages. In practice, combine it with process crash telemetry, restart counts, and client session audit logs.

Mitigation and Patching

The confirmed affected version from the available evidence is open62541 1.5.5. However, the fixed version number was not confirmed from the retrieved primary-source references. Because of that, the safest accurate guidance is: upgrade to the first open62541 release that explicitly lists a fix for CVE-2026-67863 in official project release notes or advisories. Do not guess at a target version.

If you cannot patch immediately, reduce the attack surface. Limit network reachability to trusted OPC UA clients only, restrict TCP/4840 exposure with firewall policies, and review any application code that uses local MonitoredItem callbacks. Since the trigger involves callback-driven deletion of the current MonitoredItem, integrators embedding open62541 should assess whether local callback logic can be temporarily modified or disabled to avoid the vulnerable path until a fixed release is available.

Another important mitigation is operational resilience. Enable service supervision, core dump capture where appropriate, and high-fidelity alerting on server restarts. While that does not prevent exploitation, it shortens time to detection and helps responders distinguish between ordinary instability and possible exploit attempts targeting subscription handling.

Technical Notes

If you install open62541 from source, monitor upstream and upgrade once the fix is explicitly published:

# Example source-based upgrade workflow
git clone https://github.com/open62541/open62541.git
cd open62541
git fetch --tags

# Replace <fixed-version-tag> only after the project publishes the fixed release
git checkout <fixed-version-tag>
cmake -B build -S . -DCMAKE_BUILD_TYPE=Release
cmake --build build -j"$(nproc)"
sudo cmake --install build

Until a fixed version is confirmed, apply exposure-reduction controls such as:

# Example: restrict OPC UA port 4840 to trusted management subnet
sudo iptables -A INPUT -p tcp --dport 4840 -s <trusted-subnet>/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 4840 -j DROP

If you package your own embedded application, consider temporarily disabling or refactoring local MonitoredItem callback behavior in your build pipeline where feasible. Because the exact patch is not yet confirmed here, defenders should treat network restriction plus upgrade planning as the primary immediate actions.

References

The primary authoritative reference for this CVE is the NVD entry, which identifies the bug as a server-side use-after-free in open62541 1.5.5 and describes the vulnerable sequence involving UA_Subscription_localPublish, UA_Notification, and UA_Server_deleteMonitoredItem. That is the best source for the confirmed impact and affected version in the research provided.

The open62541 project site and GitHub repository are the right places to monitor for a confirmed fixed release, advisory text, or issue discussion. Because the supplied research did not confirm a remediation version number, defenders should verify future project statements directly before rolling out an upgrade.

If you are triaging this in production, the most defensible current position is straightforward: open62541 1.5.5 is affected, the impact is remote DoS, no public exploitation is confirmed in the provided evidence, and the fixed version should be taken only from an official upstream release once published.

For further reading on related vulnerabilities, check out our articles on CVE-2026-14544 and what is OIDC.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-08-06

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.