CVE-2026-67860 Overview
CVE-2026-67860 is a heap-based buffer overflow vulnerability in open62541 version 1.5.5, an open-source implementation of the OPC UA (Unified Architecture) industrial communication protocol. The flaw resides in the default HistoryRead code path when the default history database is configured with the memory backend. Remote, unauthenticated attackers can trigger the overflow over the network to cause a denial-of-service condition against affected OPC UA servers. The weakness is classified under CWE-122: Heap-based Buffer Overflow.
Critical Impact
Unauthenticated network attackers can crash open62541 OPC UA servers processing HistoryRead requests, disrupting industrial control and monitoring workflows that depend on historical data access.
Affected Products
- open62541 version 1.5.5
- Deployments using the default history database configuration
- OPC UA servers using the memory backend for history storage
Discovery Timeline
- 2026-08-04 - CVE-2026-67860 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67860
Vulnerability Analysis
The vulnerability affects open62541 1.5.5, a C99 library implementing the OPC UA protocol used across industrial automation, SCADA, and IIoT environments. The flaw occurs in the default HistoryRead service handler when the server is configured with the built-in memory-backed history database.
OPC UA HistoryRead requests allow clients to retrieve historical values from server-managed nodes. When the server processes a crafted HistoryRead request through the default code path, memory boundaries are exceeded on the heap. This corruption results in availability loss, consistent with the impact-only-on-availability classification of the issue.
The attack requires no authentication, no user interaction, and can be delivered over the network to any exposed OPC UA endpoint offering history services.
Root Cause
The root cause is improper bounds handling within the default HistoryRead implementation paired with the memory backend history database. Insufficient validation of request-controlled parameters allows writes or reads past an allocated heap buffer, producing the CWE-122 condition. Full technical specifics are tracked in the upstream GitHub Issue Discussion.
Attack Vector
Exploitation proceeds over the network by sending a malformed OPC UA HistoryRead request to a vulnerable server that has the default memory-backed history database enabled. Because OPC UA servers are commonly deployed on operational technology networks bridging IT and OT, a single reachable endpoint can be targeted directly. The vulnerability yields a denial-of-service outcome rather than confidentiality or integrity compromise.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream GitHub Issue Discussion for reproduction details.
Detection Methods for CVE-2026-67860
Indicators of Compromise
- Unexpected termination or repeated crashes of open62541-based OPC UA server processes
- Core dumps referencing the HistoryRead service handler or memory-backend history functions
- Anomalous OPC UA HistoryRead requests originating from untrusted network segments
- Sudden loss of historical data queries from OPC UA clients in industrial environments
Detection Strategies
- Monitor OPC UA server logs for abnormal disconnects, service faults, or restarts correlated with HistoryRead activity
- Inspect network telemetry for malformed OPC UA binary protocol messages targeting history services on TCP/4840 or configured OPC UA ports
- Deploy process crash monitoring on hosts running open62541 1.5.5 to detect exploitation attempts
Monitoring Recommendations
- Baseline legitimate HistoryRead client patterns and alert on unexpected sources or volumes
- Forward OPC UA server telemetry and host crash events to a centralized SIEM for correlation
- Track the open62541 project for a fixed release and monitor deployed versions across OT assets
How to Mitigate CVE-2026-67860
Immediate Actions Required
- Inventory all systems running open62541 1.5.5 and identify servers using the default history database with the memory backend
- Restrict network exposure of OPC UA endpoints to trusted OT segments using firewall rules and network segmentation
- Disable the HistoryRead service on servers where historical data access is not required
- Enforce OPC UA client authentication and message security modes (Sign or SignAndEncrypt) where supported
Patch Information
At the time of publication, no fixed release has been referenced in the NVD entry. Track the upstream GitHub Issue Discussion and the open62541 releases page for a patched version, and upgrade once available.
Workarounds
- Disable the default memory-backed history database if the deployment does not require historical data access
- Place OPC UA servers behind an OPC UA-aware gateway or reverse proxy that filters malformed HistoryRead requests
- Apply strict network access control lists limiting which clients can reach OPC UA history services
- Enable OPC UA user authentication to reduce the population of clients able to submit HistoryRead requests
# Example: restrict access to OPC UA port 4840 to a trusted management subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
