CVE-2026-82623: open62541 Use After Free Vulnerability

CVE-2026-82623 is a use after free vulnerability in open62541 library up to version 1.5.5 affecting the History Backend component. Attackers can exploit this flaw remotely with public exploit code available. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-82623 Overview

CVE-2026-82623 is a use-after-free vulnerability [CWE-119] in the open62541 open-source OPC UA implementation, affecting versions up to 1.5.5. The flaw resides in the UA_DataValue_backend_copyRange function within plugins/historydata/ua_history_data_backend_memory.c, part of the History Backend component. Remote attackers can trigger the condition without authentication or user interaction. A public exploit exists. The upstream project closed the associated issue report, noting the submission did not follow their official security disclosure process.

Critical Impact
Remote attackers can exploit the use-after-free condition over the network to disrupt availability of OPC UA servers built on open62541, impacting industrial and IoT deployments that rely on historical data access.

Affected Products

open62541 versions up to and including 1.5.5
Deployments using the History Backend memory plugin (ua_history_data_backend_memory.c)
Downstream OPC UA server and client applications embedding vulnerable open62541 releases

Discovery Timeline

2026-08-31 - CVE-2026-82623 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82623

Vulnerability Analysis

The vulnerability is a use-after-free condition in the History Backend of open62541, an open-source implementation of the OPC Unified Architecture (OPC UA) protocol widely deployed in industrial automation, IoT, and control systems. The defect resides in UA_DataValue_backend_copyRange, a function responsible for copying ranges of historical data values from the in-memory history backend.

When the function processes historical data ranges, memory referenced during the copy operation can be freed while a pointer to that memory remains in use. Subsequent access to the dangling pointer leads to undefined behavior in the OPC UA server process. Because open62541 servers commonly expose network-facing endpoints on OPC UA ports, the attack surface extends to any client capable of issuing history read requests.

Root Cause

The root cause is improper lifetime management of UA_DataValue structures within the memory-backed history plugin. The UA_DataValue_backend_copyRange routine dereferences a data value pointer after the underlying allocation has been released. This falls under the broader CWE-119 category of improper restriction of operations within the bounds of a memory buffer, specifically manifesting as use-after-free.

Attack Vector

Exploitation occurs remotely over the network. An unauthenticated attacker with reachability to the OPC UA server endpoint can issue crafted history read requests that trigger the vulnerable code path in UA_DataValue_backend_copyRange. The public availability of the exploit lowers the barrier for opportunistic attacks against exposed open62541 deployments.

No verified proof-of-concept code is included here. Technical details are referenced in GitHub Issue #8199 and the VulDB entry for CVE-2026-82623.

Detection Methods for CVE-2026-82623

Indicators of Compromise

Unexpected termination or restart events of OPC UA server processes built on open62541
Repeated malformed or high-volume history read requests originating from a single client IP
Crash reports or core dumps referencing UA_DataValue_backend_copyRange or ua_history_data_backend_memory.c

Detection Strategies

Enable process crash telemetry and monitor for aborts within OPC UA server binaries linked against open62541
Inspect network traffic on OPC UA ports (default TCP 4840) for anomalous HistoryRead request patterns
Correlate service restarts on industrial control hosts with inbound OPC UA session activity

Monitoring Recommendations

Aggregate application and system logs from OPC UA hosts into a central SIEM or data lake for anomaly analysis
Alert on repeated crashes of the same OPC UA process within short time windows
Track outbound history read query volume from untrusted network segments

How to Mitigate CVE-2026-82623

Immediate Actions Required

Restrict network access to OPC UA endpoints so only trusted clients can reach servers built on open62541
Enforce authentication and, where supported, message signing and encryption on OPC UA sessions
Inventory all applications and firmware embedding open62541 versions up to 1.5.5

Patch Information

At the time of publication, no vendor-issued security patch has been referenced in the NVD entry for CVE-2026-82623. The upstream project closed the associated issue, citing that the report was not filed through the official security disclosure channel. Track the open62541 GitHub repository for future commits addressing UA_DataValue_backend_copyRange in plugins/historydata/ua_history_data_backend_memory.c.

Workarounds

Disable the memory-backed history backend if historical data access is not required by the deployment
Place OPC UA servers behind segmented networks and firewalls that block untrusted inbound traffic
Rate-limit or filter HistoryRead requests at the application or proxy layer until an upstream fix is available

bash

# Example: restrict inbound access to OPC UA port 4840 to a trusted management subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP