CVE-2026-67863

Received Received - Intake

Use-After-Free in open62541 OPC UA Server

Publication date: 2026-08-05

Last updated on: 2026-08-07

Assigner: MITRE

Description

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-07

Generated

2026-08-16

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-15

NVD

CVE-2026-67863

Affected Vendors & Products

Vendor	Product	Version / Range
open62541	open62541	1.5.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side use-after-free flaw in open62541 version 1.5.5. It occurs when a local MonitoredItem callback continues to use a UA_Notification object after the item has been deleted via UA_Server_deleteMonitoredItem. This creates a situation where freed memory is accessed, potentially leading to a denial of service.

Detection Guidance

This vulnerability involves a use-after-free in open62541 1.5.5 related to MonitoredItem callbacks. Detection requires checking for crashes or memory corruption in the open62541 server process when MonitoredItem operations occur. Monitor server logs for segmentation faults or abnormal terminations during MonitoredItem interactions.

Impact Analysis

An attacker could exploit this to cause a denial of service on the affected server. This means the server may crash or become unresponsive, disrupting normal operations and potentially leading to loss of availability for services relying on open62541.

Compliance Impact

This vulnerability causes a denial of service due to a use-after-free issue in the server-side MonitoredItem callback path. While it does not directly expose or leak data, a denial of service could impact availability requirements in compliance standards like GDPR or HIPAA, which mandate timely access to systems handling personal or health data.

Mitigation Strategies

Update open62541 to a version later than 1.5.5 to address the use-after-free issue in the MonitoredItem callback path.

Hi! I’m here to help you understand CVE-2026-67863. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70