CVE-2026-82623
Received Received - Intake

Use After Free in open62541 History Backend

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82623
EUVD
EUVD-2026-68367

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open62541 open62541 to 1.5.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the open62541 library up to version 1.5.5. It occurs in the History Backend component when processing a HistoryReadRequest with an extreme indexRange. The function UA_DataValue_backend_copyRange incorrectly performs a shallow memcpy before validating the indexRange, leading to ownership aliasing. When UA_Variant_copyRange fails due to exceeding UA_MAX_ARRAY_DIMS, the backend retains a dangling pointer. The failure is ignored, and the response is treated as successful, causing the server to free backend-owned historical value storage during cleanup. A subsequent normal HistoryRead then dereferences the freed memory, triggering a heap-use-after-free.

Detection Guidance

Check if your open62541 version is up to 1.5.5 or earlier. Monitor network traffic for OPC UA HistoryReadRequest messages with extreme indexRange values. Inspect server logs for crashes or memory corruption errors during historical data access.

Impact Analysis

This vulnerability allows a remote attacker to cause denial of service or undefined memory corruption on a server using the affected open62541 library. It can lead to crashes, data corruption, or potential remote code execution depending on the server's memory state and configuration.

Mitigation Strategies

Upgrade open62541 to a version beyond 1.5.5. Disable historical data access if not required. Apply input validation for indexRange in HistoryReadRequest. Monitor for exploitation attempts and apply patches from the vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart