CVE-2026-67859: open62541 Buffer Overflow DoS Vulnerability

CVE-2026-67859 Overview

CVE-2026-67859 is a buffer overflow vulnerability [CWE-120] in open62541 v1.5.5, an open source implementation of the OPC UA (OPC Unified Architecture) industrial communication protocol. The flaw resides in the Discovery/Local Discovery Server (LDS) handling code. A remote attacker can trigger the overflow over the network without authentication or user interaction to cause a denial of service on the affected server. Because open62541 is widely embedded in industrial control systems and IoT gateways, exploitation can disrupt OPC UA-based operational technology (OT) environments.

Critical Impact
Unauthenticated remote attackers can crash open62541 v1.5.5 servers by sending crafted Discovery/LDS traffic, disrupting OPC UA availability in industrial networks.

Affected Products

open62541 v1.5.5
OPC UA servers built on the open62541 Discovery/LDS components
Downstream industrial and IoT products that embed the affected open62541 release

Discovery Timeline

2026-08-04 - CVE-2026-67859 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67859

Vulnerability Analysis

The vulnerability is a classic buffer overflow [CWE-120] in the Discovery service and Local Discovery Server (LDS) code paths of open62541 v1.5.5. Discovery is an unauthenticated OPC UA subsystem used by clients to locate servers and by servers to register themselves, so the vulnerable code is reachable pre-authentication over the network.

Exploitation is limited to impacting availability. A successful attack terminates the OPC UA server process or otherwise renders it unresponsive. Confidentiality and integrity remain intact, but in OT environments the loss of the Discovery/LDS service can cascade into broader control-network disruption while operators recover the affected endpoints.

Root Cause

The root cause is improper bounds checking during processing of Discovery-related data in the open62541 library. Relevant code paths include the Discovery server example (examples/discovery/server_lds.c), the mDNS discovery implementation (src/server/ua_discovery_mdns.c), the Discovery service handler (src/server/ua_services_discovery.c), and shared helpers in src/util/ua_util.c. Attacker-controlled fields flow into fixed-size buffers without adequate length validation, allowing memory beyond the destination buffer to be written. See GitHub Issue #8095 for community discussion of the defect.

Attack Vector

The attack is delivered over the network to the OPC UA Discovery endpoint, typically TCP port 4840, or via mDNS on UDP 5353 for LDS-ME deployments. The attacker sends a malformed Discovery request (for example, FindServersRequest, RegisterServer, or an mDNS advertisement) containing an oversized field. When the server parses the request, the overflow corrupts adjacent memory and crashes the process. No credentials, session, or user interaction are required.

No verified public proof-of-concept code is currently referenced in the CVE record. Technical details are available in the linked open62541 source files and the associated GitHub issue.

Detection Methods for CVE-2026-67859

Indicators of Compromise

Unexpected termination or repeated restarts of the open62541 server process shortly after inbound Discovery traffic.
Malformed OPC UA FindServersRequest, FindServersOnNetworkRequest, or RegisterServer messages received on TCP port 4840.
Anomalous mDNS traffic on UDP 5353 targeting hosts running an LDS with oversized service or endpoint URL fields.
Core dumps or segmentation faults referencing symbols in ua_services_discovery.c or ua_discovery_mdns.c.

Detection Strategies

Inspect OPC UA traffic at the protocol layer and flag Discovery messages whose string or array fields exceed reasonable size limits.
Correlate OPC UA server crash events with preceding network traffic from the same source to identify probing attempts.
Enumerate hosts running open62541 v1.5.5 through software bill of materials (SBOM) data and prioritize monitoring on those assets.

Monitoring Recommendations

Alert on process crashes for open62541-based binaries and forward stack traces to a central log store for analysis.
Monitor for repeated TCP resets or connection failures on OPC UA Discovery ports originating from a single source.
Track mDNS query and response volume on OT network segments to detect abnormal LDS registration activity.

How to Mitigate CVE-2026-67859

Immediate Actions Required

Inventory all systems running open62541 v1.5.5, including embedded and third-party products that ship the library.
Restrict network access to OPC UA Discovery endpoints so only trusted engineering workstations and known OPC UA clients can reach TCP port 4840 and UDP 5353.
Disable the Local Discovery Server on hosts that do not require it, and remove Discovery registration for servers that clients can reach directly.
Monitor open62541 server processes for unexpected termination and configure automatic restarts with alerting.

Patch Information

At the time of publication, the CVE record references source files and GitHub Issue #8095 in the open62541 repository but does not list a fixed release. Track the open62541 repository for a patched version beyond v1.5.5 and apply it once available. Downstream vendors that embed open62541 should rebuild and redistribute their products against the patched library.

Workarounds

Segment OPC UA servers into isolated OT VLANs and enforce firewall rules that block Discovery traffic from untrusted networks.
Place an OPC UA-aware gateway or reverse proxy in front of exposed servers to validate and size-check Discovery request fields.
Disable mDNS-based discovery (LDS-ME) where clients can be configured with static endpoint URLs.
Apply rate limiting on TCP 4840 to slow brute-force overflow attempts and provide time for detection and response.

bash

# Configuration example: restrict OPC UA Discovery to trusted subnets
# Replace 10.10.20.0/24 with your engineering workstation subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 5353 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP
iptables -A INPUT -p udp --dport 5353 -j DROP