open62541 AddReferences NULL Pointer Dereference Vulnerability

Executive Summary

CVE-2026-67870 is a server-side NULL pointer dereference vulnerability in the open62541 OPC UA library (v1.5.5). It occurs when a crafted AddReferencesRequest with an empty targetServerUri and non-zero targetNodeId.serverIndex bypasses validation, causing the target node pointer to remain NULL. Later code attempts to dereference this NULL pointer, leading to a server crash or denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or unusual behavior in open62541 v1.5.5 OPC UA servers. Check server logs for segmentation faults or NULL pointer dereference errors. Use tools like AddressSanitizer or GDB to identify crashes during AddReferencesRequest processing. Monitor network traffic for malformed OPC UA requests targeting node management functions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to crash the OPC UA server by sending a specially crafted request. This results in a denial of service, disrupting operations dependent on the server. If the server is part of critical infrastructure, this could lead to operational downtime or safety risks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of open62541 beyond v1.5.5. If upgrading is not immediately possible, restrict network access to the OPC UA server using firewalls or network segmentation. Disable unnecessary node management features if they are not required for operations. Monitor for exploitation attempts and apply vendor patches as soon as they become available.

Useful 0 Not Useful 0