Open62541: 14 Critical and High-Severity Vulnerabilities Disclosed Together
Key findings • 14 vulnerabilities disclosed for Open62541, impacting version 1.5.5 and earlier. • Critical (CVSS 9.8) and High (CVSS 7.5) severity flaws dominate the batch. • Vulnerabilit…
Key findings
- 14 vulnerabilities disclosed for Open62541, impacting version 1.5.5 and earlier.
- Critical (CVSS 9.8) and High (CVSS 7.5) severity flaws dominate the batch.
- Vulnerabilities include buffer overflows, use-after-free, and incomplete validation issues.
- Most flaws lead to denial-of-service conditions for affected systems.
- Patches are available in versions subsequent to 1.5.5; immediate update recommended.
On August 5 and 6, 2026, a significant batch of 14 vulnerabilities was disclosed for the Open62541 communication library. The vulnerabilities, spanning critical and high severity ratings, primarily affect version 1.5.5 and earlier, with many leading to denial-of-service conditions through various buffer overflow and use-after-free flaws. The disclosures highlight potential risks for systems relying on Open62541 for industrial communication and data exchange.
Several vulnerabilities stem from improper handling of network requests and data validation. CVE-2026-67870, a critical flaw with a CVSSv3 score of 9.8, involves an incomplete validation for non-local ExpandedNodeId targets in the server-side AddReferences implementation. A remote attacker can exploit this by sending a crafted AddReferencesRequest, leading to a NULL target node pointer.
A cluster of high-severity buffer overflow vulnerabilities (CVE-2026-67869, CVE-2026-67862, CVE-2026-67860, CVE-2026-67859, CVE-2026-67858, CVE-2026-18784) were also disclosed. These affect different components, including Service_Call argument validation, high-level attribute reading, default HistoryRead path, and Local Discovery Server (LDS) handling, particularly when multicast discovery is enabled. These flaws can be triggered by remote attackers, leading to denial-of-service conditions.
Use-after-free vulnerabilities were also identified. CVE-2026-67863 details a server-side use-after-free in the local MonitoredItem callback path, where a notification might be used after a MonitoredItem has been deleted. Additionally, CVE-2026-67855 describes a heap use-after-free in the GDS PushManagement certificate update workflow, exploitable when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. CVE-2026-18785 also points to a use-after-free in the UA_Client_getRemoteDataTypes function.
Other denial-of-service vulnerabilities include CVE-2026-67864, related to NodeManagement type-instantiation logic, and CVE-2026-67856, which can be triggered by crafted CreateSubscription, Publish, and other related requests. CVE-2026-67857 involves an out-of-bounds read in the responseReadNamespacesArray client-side function.
The majority of these vulnerabilities are patched in versions subsequent to 1.5.5. Users of Open62541 are strongly advised to update to the latest available version to mitigate these risks. The disclosure of multiple critical and high-severity issues in a single batch underscores the importance of timely patching and security reviews for systems utilizing this communication library.
The batch of vulnerabilities was disclosed between August 4 and August 6, 2026. The disclosures highlight a range of memory corruption issues, including buffer overflows and use-after-free vulnerabilities, primarily impacting Open62541 version 1.5.5. The most severe flaw, CVE-2026-67870, carries a critical CVSSv3 score of 9.8.
The vulnerabilities were reported by various sources, with a significant number disclosed on August 4th and 5th, followed by the critical CVE-2026-67870 on August 6th. The affected component is the Open62541 library, a widely used open-source implementation of the OPC UA (Open Platform Communications Unified Architecture) standard, crucial for industrial automation and IoT communications.
The impact of these vulnerabilities ranges from denial of service to potential information disclosure or even code execution in more severe cases, although the provided descriptions predominantly point towards DoS. The clustered disclosure suggests a coordinated release of findings, emphasizing the need for prompt attention from developers and system administrators.
Users are urged to upgrade to patched versions of Open62541. The specific version containing the fixes is not detailed in the provided CVE information, but it is implied that versions later than 1.5.5 address these issues. Given the critical nature of some flaws, immediate patching is recommended to prevent potential disruptions and security breaches.
The timely patching of these vulnerabilities is crucial for maintaining the security and reliability of industrial control systems and IoT deployments that rely on Open62541. The concentration of high and critical severity issues in this batch serves as a reminder of the ongoing security challenges in the IIoT landscape.
CVE-2026-67870, a critical vulnerability, impacts the server-side AddReferences implementation due to incomplete validation of non-local ExpandedNodeId targets. Multiple high-severity buffer overflow vulnerabilities (e.g., CVE-2026-67869, CVE-2026-67862) affect various components, leading to denial-of-service. Use-after-free flaws, such as CVE-2026-67863 and CVE-2026-67855, were identified in different operational paths within the library. The majority of the disclosed vulnerabilities affect Open62541 version 1.5.5 and earlier. Patches are available in versions subsequent to 1.5.5, and users are strongly advised to update. The disclosures occurred between August 4 and August 6, 2026, highlighting a significant security event for Open62541 users.