CVE-2026-67862: open62541 Buffer Overflow DoS Vulnerability

CVE-2026-67862 Overview

CVE-2026-67862 is a buffer overflow vulnerability in open62541 version 1.5.5, an open-source implementation of the OPC UA (Open Platform Communications Unified Architecture) protocol. The flaw resides in the high-level attribute reading logic within src/client/ua_client_highlevel.c. A remote attacker can trigger the overflow to cause a denial of service against affected client applications. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and requires no authentication or user interaction to exploit over the network.

Critical Impact
Remote, unauthenticated attackers can crash open62541 client processes by exploiting the buffer overflow in attribute reading logic, disrupting industrial and IoT communication built on OPC UA.

Affected Products

open62541 version 1.5.5
Applications and industrial systems embedding the open62541 client library
OPC UA client implementations built on the vulnerable ua_client_highlevel.c code path

Discovery Timeline

2026-08-04 - CVE-2026-67862 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67862

Vulnerability Analysis

The open62541 library provides a client-side helper API for interacting with OPC UA servers, including reading node attributes through functions in src/client/ua_client_highlevel.c. Version 1.5.5 contains a buffer overflow condition in this high-level attribute reading logic. When the client processes attribute responses from a server, insufficient bounds validation allows data to exceed the allocated buffer. The result is a memory corruption condition that leads to process termination and denial of service. Because open62541 clients are commonly deployed in industrial control, building automation, and IoT gateways, availability loss can disrupt operational technology environments.

Root Cause

The root cause is inadequate boundary validation in the attribute reading routines of ua_client_highlevel.c. The code path fails to properly constrain the size of data copied into fixed-size buffers when parsing attribute values returned by an OPC UA server. This aligns with CWE-400, where resource consumption is not properly bounded. Additional technical context is available in the upstream GitHub Issue #8139 and the vulnerable client source file.

Attack Vector

An attacker controls a malicious or compromised OPC UA server, or performs a man-in-the-middle attack on unencrypted OPC UA sessions. When a vulnerable open62541 1.5.5 client connects and issues an attribute read, the attacker returns a crafted response that overflows the client-side buffer. Exploitation requires no credentials and no user interaction. Because OPC UA typically runs over TCP port 4840, network-reachable clients are exposed whenever they initiate outbound connections to attacker-controlled endpoints. No public proof-of-concept exploit is currently listed for this issue.

No verified exploit code is available. See the upstream issue tracker
for technical discussion: https://github.com/open62541/open62541/issues/8139

Detection Methods for CVE-2026-67862

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libopen62541 version 1.5.5
Repeated client reconnect loops following attribute read operations against untrusted OPC UA servers
OPC UA client connections to unexpected external endpoints on TCP port 4840

Detection Strategies

Inventory build artifacts and container images to identify components statically or dynamically linked against open62541 1.5.5
Monitor process crash telemetry on hosts running OPC UA client workloads and correlate with recent network sessions
Inspect OPC UA server endpoints reached by clients and flag connections to endpoints outside an approved allowlist

Monitoring Recommendations

Enable core dump collection on industrial gateways and SCADA hosts to capture evidence of client-side crashes
Log all outbound OPC UA sessions (TCP/4840) with source process, destination, and session duration
Alert on abnormal termination of long-running OPC UA client services followed by automatic restart cycles

How to Mitigate CVE-2026-67862

Immediate Actions Required

Identify all deployments of open62541 1.5.5 across development, build, and production environments
Restrict outbound OPC UA client connections to a known, trusted set of server endpoints
Isolate industrial control networks running OPC UA clients from untrusted networks and internet-facing systems

Patch Information

No fixed version is referenced in the current NVD entry. Track the upstream GitHub Issue #8139 for the official fix and upgrade guidance from the open62541 maintainers. Rebuild and redeploy dependent applications once a patched release becomes available.

Workarounds

Enforce mutual authentication and message signing on OPC UA sessions to prevent connections to unauthorized servers
Use network segmentation and firewall rules to block open62541 clients from reaching untrusted OPC UA endpoints
Where feasible, downgrade to a prior open62541 release not affected by this attribute reading defect, or apply a locally maintained patch until an upstream fix is released

bash

# Example: restrict outbound OPC UA (TCP/4840) to an allowlisted server
iptables -A OUTPUT -p tcp --dport 4840 -d 10.10.20.15 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -j DROP