Buffer Overflow in open62541

Executive Summary

CVE-2026-67869 is a type confusion vulnerability in the open62541 OPC UA library affecting the Acknowledge method for Alarms & Conditions. It occurs due to a mismatch between service-layer validation of method arguments and fixed assumptions made by the built-in callback. An attacker can exploit this by modifying InputArguments metadata to replace the standard method signature with a forged one, causing the callback to misinterpret a Boolean object as a UA_ByteString. This leads to an out-of-bounds read and heap-buffer-overflow, resulting in a denial-of-service (server crash).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor OPC UA server logs for crashes or unexpected behavior during method calls or condition state changes. Use AddressSanitizer or similar tools to detect heap-buffer-overflows during server operations. Check for malformed InputArguments metadata in method calls or condition callbacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow remote attackers to cause a denial of service by crashing the OPC UA server. An attacker could exploit it to execute arbitrary code or disrupt server operations, potentially leading to unauthorized state changes or other malicious activities within the server environment.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade open62541 to a patched version beyond v1.5.5. Disable or restrict access to OPC UA method calls and condition state modifications until patched. Implement strict input validation for method arguments and condition callbacks. Monitor for suspicious sequences of operations like CreateSession, ActivateSession, and Call.

Useful 0 Not Useful 0