CVE-2026-67855: open62541 Use-After-Free Vulnerability

CVE-2026-67855 Overview

CVE-2026-67855 is a heap use-after-free vulnerability in open62541, an open-source implementation of the OPC UA (OPC Unified Architecture) protocol stack. The flaw resides in the Global Discovery Server (GDS) PushManagement certificate update workflow and is exposed when the UA_ENABLE_GDS_PUSHMANAGEMENT build option is enabled. A remote attacker can trigger the use-after-free by exercising the certificate update flow, causing the server process to crash. The issue is tracked under CWE-400 (Uncontrolled Resource Consumption) and impacts availability of OPC UA servers built on the affected library.

Critical Impact
Unauthenticated remote attackers can crash open62541-based OPC UA servers over the network, disrupting industrial and IIoT communications that rely on the affected GDS push certificate management workflow.

Affected Products

open62541 OPC UA server library builds with UA_ENABLE_GDS_PUSHMANAGEMENT enabled
Applications embedding open62541 that expose the GDS PushManagement certificate update workflow
Industrial and IIoT deployments using open62541 as their OPC UA stack

Discovery Timeline

2026-08-04 - CVE-2026-67855 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67855

Vulnerability Analysis

The vulnerability affects the GDS PushManagement code path in open62541, an OPC UA (Open Platform Communications Unified Architecture) server library used in industrial automation. GDS PushManagement is the OPC UA facility that allows a Global Discovery Server to push new certificates and trust list updates to a server. When UA_ENABLE_GDS_PUSHMANAGEMENT is compiled in, the server exposes methods that walk internal certificate state during an update cycle. During this workflow, a heap object is freed while another code path continues to reference the same allocation, producing a classic use-after-free condition. Dereferencing the stale pointer during method invocation causes memory corruption that terminates the server process. Because the attack vector is network-based and requires no authentication or user interaction, any exposed instance can be crashed remotely. Details of the underlying defect are tracked in open62541 GitHub Issue #8093.

Root Cause

The root cause is improper lifetime management of heap-allocated certificate state during the PushManagement update sequence. Code in src/server/ua_server_ns0_gds.c and related server-internal logic frees a certificate-related structure while another reference remains active, violating pointer ownership. The condition is classified under CWE-400 as an availability-impacting resource handling error.

Attack Vector

An attacker with network access to the OPC UA endpoint invokes the GDS PushManagement certificate update methods on a server compiled with UA_ENABLE_GDS_PUSHMANAGEMENT. Triggering the vulnerable sequence dereferences a freed heap allocation and crashes the server. No user interaction is required, and the impact is limited to denial of service — confidentiality and integrity are not affected.

No public proof-of-concept is available at the time of publication. See the upstream open62541 repository and Issue #8093 for technical context.

Detection Methods for CVE-2026-67855

Indicators of Compromise

Unexpected termination or repeated restarts of open62541-based OPC UA server processes
Crash reports or core dumps referencing functions in ua_server_ns0_gds.c or the event loop in arch/posix/eventloop_posix.c
Inbound OPC UA sessions invoking GDS PushManagement methods (for example, UpdateCertificate) from unexpected clients or networks

Detection Strategies

Enable AddressSanitizer or heap-hardening allocators in test and staging builds to catch use-after-free conditions during PushManagement workflow exercises
Alert on abnormal termination signals (SIGSEGV, SIGABRT) from processes linked against open62541
Correlate OPC UA method call telemetry with subsequent server availability drops to identify targeted crash attempts

Monitoring Recommendations

Continuously monitor the availability and uptime of OPC UA servers and alert on repeated restarts within short windows
Log all GDS PushManagement method invocations, including source IP, session, and certificate identifiers
Baseline expected GDS traffic and flag any PushManagement activity originating from outside authorized management networks

How to Mitigate CVE-2026-67855

Immediate Actions Required

Inventory all applications built against open62541 and identify those compiled with UA_ENABLE_GDS_PUSHMANAGEMENT enabled
Restrict network access to OPC UA endpoints so only trusted GDS clients can reach the PushManagement interface
Track open62541 Issue #8093 and apply upstream fixes as soon as they merge into a tagged release

Patch Information

At the time of publication, no fixed release version is listed in the NVD advisory. Consumers of open62541 should monitor the open62541 GitHub repository for a commit that closes Issue #8093 and rebuild dependent applications against the patched source. Vendors shipping firmware or products that embed open62541 should issue updated builds once upstream fixes are available.

Workarounds

Rebuild open62541 with UA_ENABLE_GDS_PUSHMANAGEMENT disabled if GDS push certificate management is not required in the deployment
Place OPC UA servers behind network segmentation and firewalls that restrict PushManagement calls to authenticated management hosts only
Enforce strict OPC UA security policies and require certificate-based authentication for any client permitted to reach the GDS interface

bash

# Rebuild open62541 without the vulnerable GDS PushManagement feature
cmake -DUA_ENABLE_GDS_PUSHMANAGEMENT=OFF \
      -DUA_ENABLE_ENCRYPTION=ON \
      -B build -S .
cmake --build build --target open62541