CVE-2026-67858: open62541 Buffer Overflow DoS Vulnerability

CVE-2026-67858 Overview

CVE-2026-67858 is a buffer overflow vulnerability [CWE-120] in open62541 version 1.5.5, an open-source implementation of the OPC UA (Open Platform Communications Unified Architecture) protocol. The flaw affects deployments where the Local Discovery Server (LDS) is built with multicast discovery enabled through the Multicast DNS Daemon (MDNSD) backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls, triggering the overflow and causing denial of service on the target LDS.

Critical Impact
Unauthenticated network attackers can crash open62541 Local Discovery Servers built with MDNSD multicast discovery, disrupting OPC UA service discovery across industrial and OT networks.

Affected Products

open62541 1.5.5 built with multicast discovery enabled
Local Discovery Server (LDS) deployments using the MDNSD backend
OPC UA server discovery components exposed to untrusted networks

Discovery Timeline

2026-08-04 - CVE-2026-67858 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67858

Vulnerability Analysis

The vulnerability resides in the discovery service handling within open62541, specifically in the multicast DNS integration used by the Local Discovery Server. When multicast discovery is enabled through MDNSD, incoming RegisterServer and RegisterServer2 service requests provide a list of discoveryUrls that the LDS registers and advertises. The registration logic fails to bound the number and cumulative size of unique URLs supplied by a remote client. Supplying many unique URLs in a single request drives writes past the allocated buffer boundaries, corrupting adjacent memory and terminating the LDS process.

Because OPC UA discovery services are commonly reachable across operational technology (OT) network segments, the vulnerability can be triggered without prior authentication or user interaction. Successful exploitation renders the discovery service unavailable, disrupting the ability of OPC UA clients to enumerate and connect to registered servers.

Root Cause

The root cause is missing input length validation on the discoveryUrls array in the RegisterServer and RegisterServer2 handlers. The affected code paths live in src/server/ua_services_discovery.c and src/server/ua_discovery_mdns.c. Fixed-size buffers or bounded iteration constructs do not adequately account for attacker-controlled URL counts, resulting in a classic buffer overflow condition [CWE-120]. See GitHub Issue #8094 for upstream discussion.

Attack Vector

Exploitation requires network reachability to the LDS listener, typically on the OPC UA default TCP port. The attacker crafts a RegisterServer or RegisterServer2 request populated with a large set of unique discoveryUrls values and sends it to the target. No credentials, session establishment beyond the discovery handshake, or user interaction are required. The overflow corrupts LDS memory and causes the process to abort, producing sustained denial of service until the daemon is restarted.

The vulnerability affects only builds with multicast discovery compiled in. Refer to the open62541 building documentation and discovery examples for build-time flags that determine exposure.

Detection Methods for CVE-2026-67858

Indicators of Compromise

Unexpected termination or repeated restarts of open62541 LDS processes on OPC UA infrastructure hosts
Inbound OPC UA discovery traffic containing RegisterServer or RegisterServer2 requests with unusually large discoveryUrls arrays
Multicast DNS (mDNS) traffic bursts from unexpected sources targeting LDS hosts

Detection Strategies

Inspect OPC UA discovery service logs for malformed or oversized RegisterServer2 payloads preceding process crashes
Deploy protocol-aware network sensors that decode OPC UA binary framing and flag RegisterServer messages exceeding baseline discoveryUrls counts
Correlate host-side crash telemetry (core dumps, systemd restart counters) for the open62541 LDS binary with concurrent inbound discovery traffic

Monitoring Recommendations

Alert on repeated LDS service restarts within short time windows on OT and industrial hosts
Monitor exposure of TCP/4840 and mDNS UDP/5353 to untrusted network segments
Track outbound telemetry from OPC UA hosts for anomalies that suggest post-crash exploitation follow-on activity

How to Mitigate CVE-2026-67858

Immediate Actions Required

Identify all open62541 deployments at version 1.5.5 and determine whether they were compiled with multicast discovery enabled through the MDNSD backend
Restrict network access to LDS listeners so that only trusted OPC UA clients can reach the discovery service
Rebuild or replace vulnerable LDS instances with a version incorporating the upstream fix once available

Patch Information

At the time of publication, no fixed version identifier is listed in NVD. Track the upstream repository, particularly GitHub Issue #8094 and the affected source files ua_services_discovery.c and ua_discovery_mdns.c, for the corrective commit and updated releases.

Workarounds

Rebuild open62541 without multicast discovery support if the MDNSD-backed LDS is not required for the deployment
Place LDS instances behind firewall rules that permit RegisterServer and RegisterServer2 requests only from authenticated OPC UA server hosts
Segment OPC UA discovery traffic onto dedicated OT VLANs and block cross-segment mDNS forwarding
Configure process supervisors to rate-limit automatic restarts to prevent crash-loop amplification during attack attempts

bash

# Configuration example: rebuild open62541 with multicast discovery disabled
cmake -DUA_ENABLE_DISCOVERY=ON \
      -DUA_ENABLE_DISCOVERY_MULTICAST=OFF \
      -DUA_ENABLE_DISCOVERY_SEMAPHORE=OFF \
      ..
make -j$(nproc)