CVE-2026-67863: open62541 Use-After-Free Vulnerability

CVE-2026-67863 Overview

CVE-2026-67863 is a server-side use-after-free vulnerability in open62541 version 1.5.5, an open-source implementation of the OPC Unified Architecture (OPC UA) protocol. The flaw exists in the local MonitoredItem callback path. The function UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. A remote attacker can trigger the condition to cause a denial of service against the OPC UA server.

Critical Impact
Remote, unauthenticated attackers can crash an open62541 1.5.5 server by exploiting the use-after-free in the local publish path, disrupting industrial and IoT communications that rely on OPC UA.

Affected Products

open62541 version 1.5.5
OPC UA servers built on the affected open62541 release
Industrial and IoT deployments embedding the vulnerable ua_subscription.c publish path

Discovery Timeline

2026-08-05 - CVE-2026-67863 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67863

Vulnerability Analysis

The vulnerability resides in the subscription publish path implemented in src/server/ua_subscription.c. open62541 supports local MonitoredItem objects that dispatch notifications through user-supplied callbacks rather than sending them over the network. During UA_Subscription_localPublish, the server iterates active notifications and invokes each item's callback.

The callback context is permitted to call UA_Server_deleteMonitoredItem, defined in include/open62541/server.h and implemented in src/server/ua_services_monitoreditem.c. That call frees the current MonitoredItem and its associated UA_Notification structures. Control then returns to UA_Subscription_localPublish, which continues to dereference the freed UA_Notification, producing a classic use-after-free ([CWE-416]).

The result is memory corruption inside the server process. In practice, this manifests as a denial of service because the server accesses freed heap memory during notification dispatch, leading to a crash of the OPC UA endpoint.

Root Cause

The root cause is a lifetime management error. UA_Subscription_localPublish retains a pointer to the current UA_Notification across a callback that is permitted to delete the enclosing MonitoredItem. The publish loop does not re-validate the notification pointer, snapshot required fields before the callback, or refuse deletion of the item currently being serviced. See open62541 GitHub Issue #8131 for maintainer discussion.

Attack Vector

Exploitation is network-based and does not require authentication or user interaction. An attacker with reachability to the OPC UA server subscribes to nodes and issues requests that drive the local publish path, then triggers a state change that causes the registered callback to remove the same MonitoredItem being processed. When the publish loop resumes, the freed notification is dereferenced and the server crashes. No verified public exploit is currently listed.

Detection Methods for CVE-2026-67863

Indicators of Compromise

Unexpected crashes or restarts of open62541-based OPC UA server processes
Segmentation faults or heap corruption traces in host logs referencing UA_Subscription_localPublish or UA_Server_deleteMonitoredItem
Repeated CreateMonitoredItems and DeleteMonitoredItems requests from a single OPC UA client within short intervals

Detection Strategies

Enable AddressSanitizer or similar heap instrumentation in non-production builds to surface the use-after-free during fuzzing and regression tests
Monitor process supervisors (systemd, Kubernetes) for repeated restart loops on OPC UA workloads
Inspect OPC UA server logs for abnormal subscription lifecycle activity preceding a crash

Monitoring Recommendations

Alert on OPC UA server availability drops using synthetic OPC UA client probes
Capture core dumps from open62541 processes and analyze stack frames touching ua_subscription.c
Baseline the rate of MonitoredItem create and delete operations per client and flag outliers

How to Mitigate CVE-2026-67863

Immediate Actions Required

Restrict network reachability of open62541 1.5.5 servers to trusted OPC UA clients only
Track open62541 GitHub Issue #8131 for a fixed release and upgrade as soon as a patched version is published
Audit deployed OPC UA servers to identify instances running the vulnerable 1.5.5 build

Patch Information

At the time of NVD publication, no fixed release is referenced in the advisory. Users should follow the upstream project at the open62541 repository and review the affected files: server.h, ua_services_monitoreditem.c, and ua_subscription.c.

Workarounds

Avoid registering local MonitoredItem callbacks that invoke UA_Server_deleteMonitoredItem on the item currently being serviced; defer deletion to a later event loop iteration
Place OPC UA servers behind a segmentation boundary or firewall that restricts access to allow-listed engineering workstations
Enable process auto-restart with rate limiting to reduce availability impact while a permanent fix is deployed

bash

# Configuration example: restrict OPC UA server exposure with iptables
iptables -A INPUT -p tcp --dport 4840 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP