Use-After-Free in open62541 OPC UA Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: MITRE

Description

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-67863

Affected Vendors & Products

Vendor	Product	Version / Range
open62541	open62541	1.5.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side use-after-free flaw in open62541 version 1.5.5. It occurs when a local MonitoredItem callback continues to use a UA_Notification object after the item has been deleted via UA_Server_deleteMonitoredItem. This creates a situation where freed memory is accessed, potentially leading to a denial of service.

Impact Analysis

An attacker could exploit this to cause a denial of service on the affected server. This means the server may crash or become unresponsive, disrupting normal operations and potentially leading to loss of availability for services relying on open62541.

Mitigation Strategies

Update open62541 to a version later than 1.5.5 to address the use-after-free issue in the MonitoredItem callback path.

Hi! I’m here to help you understand CVE-2026-67863. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70