CVE-2026-67857: open62541 Buffer Overflow Vulnerability

CVE-2026-67857 Overview

CVE-2026-67857 is an out-of-bounds read vulnerability in open62541 version 1.5.5, an open source implementation of the OPC Unified Architecture (OPC UA) protocol. The flaw resides in the client-side function responseReadNamespacesArray() located in src/client/ua_client_connect.c. A remote attacker can trigger the condition by causing an affected client to process a crafted server response during connection establishment. Successful exploitation leads to a denial-of-service condition against the client process. The weakness is categorized as [CWE-125] Out-of-bounds Read.

Critical Impact
A network-reachable attacker can crash open62541 1.5.5 OPC UA clients by returning malformed data during namespace array reads, disrupting industrial control and automation workflows that depend on the client.

Affected Products

open62541 version 1.5.5
Client applications built against the affected ua_client_connect.c component
Downstream OPC UA integrations that link the vulnerable library

Discovery Timeline

2026-08-04 - CVE-2026-67857 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67857

Vulnerability Analysis

The vulnerability affects responseReadNamespacesArray(), a client-side routine invoked during the connection sequence in open62541 1.5.5. The function processes the namespace array returned by the remote OPC UA server. When the response is malformed or omits expected fields, the function reads memory outside the bounds of the intended buffer. The result is a read of adjacent heap or stack memory, which typically produces a segmentation fault or terminates the client process. Because the bug is reachable over the network without authentication or user interaction, any server that a client connects to can trigger the crash.

Root Cause

The root cause is missing or insufficient validation of the size and structure of the namespace array returned by the server before the client dereferences elements of that array. The affected code path assumes that the response contains a valid element count and matching entries. When the assumption is violated, the loop or index operation in responseReadNamespacesArray() reads past the allocated buffer. This is a classic [CWE-125] Out-of-bounds Read pattern in C code that trusts attacker-controlled length fields.

Attack Vector

Exploitation is straightforward for an attacker who controls or impersonates an OPC UA server. The attacker returns a crafted response to a Read request for the namespaces array during the client connection handshake. Because OPC UA clients often connect to remote endpoints across operational technology networks, the attack surface includes any deployment where a client can be redirected to a malicious endpoint. There are no known public exploits at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Reference material for the affected code is available in the open62541 client_connect example and the ua_client_connect.c source. Additional context is tracked in open62541 issue #8104 and reporter issue #9.

Detection Methods for CVE-2026-67857

Indicators of Compromise

Unexpected termination or segmentation faults of open62541-based client processes shortly after initiating a connection to an OPC UA server.
Core dumps or crash reports referencing responseReadNamespacesArray or ua_client_connect.c in the stack trace.
Repeated client reconnect loops against a specific remote endpoint returning malformed ReadResponse messages.

Detection Strategies

Inventory binaries and containers to identify software statically or dynamically linked against open62541 1.5.5.
Inspect OPC UA network traffic for ReadResponse messages containing inconsistent array length fields or truncated namespace payloads.
Correlate client crash telemetry with outbound OPC UA session activity to identify servers triggering the fault.

Monitoring Recommendations

Alert on abnormal termination of processes that embed the open62541 client library on engineering workstations and gateway hosts.
Monitor OPC UA connection attempts to endpoints outside of an approved server allowlist.
Log and review the source addresses of servers responding to Read requests for Server_NamespaceArray during client handshake.

How to Mitigate CVE-2026-67857

Immediate Actions Required

Identify every deployment running open62541 1.5.5 and record the applications that link the library.
Restrict outbound OPC UA client connections to known, trusted server endpoints using network segmentation and firewall rules.
Treat client crashes during connection setup as potential exploitation attempts and preserve associated core dumps for analysis.

Patch Information

No fixed release is referenced in the NVD record at the time of publication. Track upstream fixes through the open62541 issue tracker and rebuild dependent applications once a patched version is available. Until a fix is published, apply compensating controls at the network and host layer.

Workarounds

Configure OPC UA clients to connect only to authenticated servers using certificate-based endpoint validation and reject anonymous or untrusted endpoints.
Place OPC UA clients and servers on isolated network segments to prevent unauthorized servers from reaching client processes.
Run client processes under supervision so that crashes are logged, restarted safely, and do not cascade into control-loop failures.

bash

# Example egress firewall rule limiting OPC UA client traffic (default port 4840) to an approved server
iptables -A OUTPUT -p tcp --dport 4840 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -j DROP