Null Pointer Dereference in open62541 Shared Client Library

Executive Summary

CVE-2026-15690 is a vulnerability in the open62541 OPC UA client library, specifically affecting versions up to 1.5.5. The issue occurs in the `responseReadNamespacesArray` function within the file `src/client/ua_client_connect.c`.

During the OPC UA connection handshake after session activation, the client automatically sends a Read request for the `Server_NamespaceArray`. A malicious OPC UA server can exploit this by returning a ReadResponse with `resultsSize == 0` but encoding the results as an empty array using the `UA_EMPTY_ARRAY_SENTINEL` pointer (`(void*)0x01`) instead of NULL. The client then incorrectly dereferences `resp->results[0]`, leading to an invalid memory read from address `0x19` and causing a client crash.

This is classified as a null pointer dereference vulnerability, which can be triggered remotely over the standard OPC UA TCP protocol. The attack requires a high level of complexity, and exploitation is considered difficult. The impact is limited to a client-side denial of service (DoS), as no code execution or controlled memory write has been demonstrated.

• Affected component: Shared Client Library in open62541.
• Vulnerable function: `responseReadNamespacesArray()` in `src/client/ua_client_connect.c`.
• Root cause: Insufficient validation of the ReadResponse structure before dereferencing nested fields.
• Exploitation vector: Malicious OPC UA server manipulating the `Server_NamespaceArray` read response.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability on your network or system involves monitoring OPC UA client behavior and inspecting network traffic for malicious responses from OPC UA servers. Since the vulnerability is triggered by a malformed Server_NamespaceArray response, you can use the following approaches:

• Network traffic analysis: Use a packet capture tool like Wireshark to inspect OPC UA TCP traffic. Look for ReadResponse messages where the resultsSize is 0 but the results field is encoded as an empty array sentinel (UA_EMPTY_ARRAY_SENTINEL, 0x01). This may indicate an attempt to exploit the vulnerability.
• Command for Wireshark: Start a capture on the relevant interface with a filter for OPC UA traffic, such as 'tcp.port == 4840' (default OPC UA port). Analyze ReadResponse packets for anomalous resultsSize and results field combinations.
• Client-side logging: Enable verbose logging in open62541 clients to detect crashes or unexpected behavior during connection handshakes. Check logs for errors related to the responseReadNamespacesArray function or null pointer dereferences.
• Crash detection: Monitor open62541 client processes for unexpected terminations. If clients crash after connecting to a server, it may indicate exploitation of this vulnerability.
• Static analysis: Use static code analysis tools to scan the open62541 client library for insufficient validation of ReadResponse structures. Focus on the responseReadNamespacesArray function in src/client/ua_client_connect.c.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of the open62541 OPC UA client library (up to 1.5.5), this vulnerability can impact you in the following ways:

• Denial of Service (DoS): A malicious OPC UA server can crash your client application by exploiting this vulnerability during the connection handshake. This can disrupt operations that rely on OPC UA communication.
• Remote Exploitation: The attack can be executed remotely over the standard OPC UA TCP protocol, meaning an attacker does not need physical access to your systems to exploit the vulnerability.
• No Data Loss or Code Execution: The vulnerability does not allow for arbitrary code execution or controlled memory writes, so the impact is limited to crashing the client. There is no evidence of data exfiltration or corruption.
• Operational Disruption: If your systems depend on continuous OPC UA client connectivity, repeated crashes could lead to operational downtime or degraded performance.

Useful 0 Not Useful 0

Compliance Impact

The impact of CVE-2026-15690 on compliance with common standards and regulations depends on how the affected OPC UA client is used in your environment. Below are potential considerations:

• GDPR (General Data Protection Regulation): This vulnerability does not directly involve the processing or exposure of personal data. However, if the OPC UA client is part of a system that handles personal data, a denial of service (DoS) attack could disrupt the availability of that system. GDPR requires ensuring the availability and resilience of systems processing personal data. Prolonged downtime due to this vulnerability could be seen as a failure to meet these requirements.
• HIPAA (Health Insurance Portability and Accountability Act): If the OPC UA client is used in a healthcare environment to transmit or process protected health information (PHI), a DoS attack could disrupt access to critical systems. HIPAA requires ensuring the confidentiality, integrity, and availability of PHI. While this vulnerability does not expose PHI, it could impact availability, which may need to be addressed in risk assessments or incident reports.
• Industrial Standards (e.g., IEC 62443, NIST SP 800-82): For industrial control systems (ICS) or operational technology (OT) environments, this vulnerability could be relevant if the OPC UA client is part of a critical infrastructure. Standards like IEC 62443 emphasize the importance of system availability and resilience. A DoS vulnerability could be flagged during compliance audits if it affects the reliability of industrial processes.
• General Security Frameworks (e.g., ISO 27001, NIST CSF): These frameworks require organizations to manage vulnerabilities and ensure the availability of systems. This vulnerability would need to be addressed as part of vulnerability management processes, including patching, mitigating, or documenting compensating controls to maintain compliance.

While the vulnerability itself does not directly violate compliance requirements, its exploitation could lead to secondary effects (e.g., downtime) that may conflict with regulatory or standards-based obligations. Organizations should assess the risk based on their specific use cases and environments.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade the open62541 library: Update to the latest version of open62541 that includes the fix for this vulnerability. The fix involves validating resultsSize >= 1 and adding structural checks before accessing resp->results[0].
• Apply a patch: If upgrading is not immediately possible, apply a patch to the affected function (responseReadNamespacesArray in src/client/ua_client_connect.c). Ensure the patch includes validation for resultsSize and proper handling of the results field.
• Network segmentation: Isolate OPC UA clients from untrusted networks or servers. Restrict access to trusted OPC UA servers only to reduce the risk of exploitation.
• Firewall rules: Configure firewalls to block or monitor OPC UA traffic (default port 4840) from unknown or untrusted sources. This can prevent malicious servers from reaching vulnerable clients.
• Disable automatic namespace array reads: If possible, disable the automatic Read request for Server_NamespaceArray in the client configuration. This may prevent the vulnerability from being triggered but could impact functionality.
• Monitor for crashes: Set up monitoring for open62541 client crashes, particularly those occurring during connection handshakes. Investigate any crashes for signs of exploitation.

Useful 0 Not Useful 0