Which versions of open62541 are affected by CVE-2026-63035?

A use-after-free vulnerability in open62541, a foundational OPC UA protocol library, allows authenticated attackers to corrupt server memory and interrupt critical manufacturing, energy, or…

How to fix or mitigate CVE-2026-63035?

Within 24 hours: conduct an inventory of all systems running open62541 to identify which versions 1.3.0-1.3.18, 1.4.0-1.4.17, 1.5.0-1.5.5, or other vulnerable releases are deployed in your OPC UA infrastructure. Within 7 days: begin staged deployment of patches v1.3.19, v1.4.18, or v1.5.6 (matching your current versions) to production systems, prioritizing servers managing critical industrial operations and those exposed to untrusted networks. Within 30 days: complete patching across all affected systems, validate operational stability through monitoring, and review network segmentation and access controls to limit OPC UA server accessibility to necessary authenticated users only.

open62541 CVE-2026-63035

Q: What is the CVSS score of CVE-2026-63035?

CVE-2026-63035 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-51334 HIGH

Use After Free (CWE-416)

2026-07-30

GHSA-w956-qq95-g5q3

RCE Use After Free Memory Corruption

7.2

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable via OPC UA port, low complexity with standard service calls, session required (PR:L, though anonymous by default), no confidentiality leak confirmed, high integrity and availability per advisory characterisation of heap write.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:16 vuln.today

CVE Published

Jul 30, 2026 - 19:39 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Use-after-free in open62541's TransferSubscriptions service allows a low-privileged, network-accessible attacker to corrupt heap memory on OPC UA servers running versions 1.3.0 through 1.3.18, 1.4.0 through 1.4.17, and 1.5.0 through 1.5.5, with CVSS v3.1 scoring 8.1 (High). The flaw arises from incomplete intrusive-list migration during session transfer - a stale back-pointer into the freed subscription struct is written through when a monitored item is later removed - and was reproduced as a confirmed heap use-after-free write under AddressSanitizer; no public exploit code is identified at time of analysis (withheld at o6 Automation's request). Vendor-released patches v1.3.19, v1.4.18, and v1.5.6 were published 2026-07-27 and are confirmed to contain the fix; CISA published coordinated advisory ICSA-26-211-08 on 2026-07-30.

Technical ContextAI

open62541 is an open-source C implementation of OPC UA (IEC 62541), the interoperability standard for industrial automation, maintained by o6 Automation GmbH and originally developed with Fraunhofer IOSB. It is designed for embedding in controllers, gateways, and edge devices running on Windows and Linux. CWE-416 (Use After Free) is the root cause: the TransferSubscriptions service, which migrates a subscription from one OPC UA session to another, copied the subscription struct and correctly migrated three of its intrusive linked lists to the new owner, but omitted the samplingMonitoredItems list. The head entry of that list retained an le_prev back-pointer into the now-freed old struct. When a monitored item in that list was subsequently removed - a routine operation - the removal routine wrote through the stale pointer, producing a heap use-after-free write. The bug was confirmed on branch 1.4 at commit c132505de across macOS arm64 and Linux x86-64 under AddressSanitizer. Notably, v1.4.17 and v1.5.5 introduced a separate access-control fix (o6 SA-2026-0005) that restricted transfer of detached subscriptions, but the underlying list-migration memory-safety defect survived into those releases and was only eliminated in v1.4.18 and v1.5.6.

RemediationAI

The primary fix is to upgrade to v1.3.19, v1.4.18, or v1.5.6, all released 2026-07-27 and confirmed by the researcher to contain the list-migration fix for CVE-2026-63035. Release tags are at https://github.com/open62541/open62541/releases/tag/v1.5.6, v1.4.18, and v1.3.19; the o6 Automation advisory reference is SA-2026-0015. For downstream vendors who vendor open62541 into their own products, the researcher specifically advises checking the embedded copy rather than the build host's package and verifying build options, as compiled-in feature sets determine which of the four CVEs apply. If immediate patching is not possible, restricting access-control policy to prevent anonymous session creation eliminates the lowest-friction path to exploitation (note: this is a configuration change with operational impact in environments relying on anonymous OPC UA access). Placing OPC UA endpoints behind network segmentation on trusted networks limits exposure to the AV:N vector. Note that v1.4.17 and v1.5.5 introduced a related access-control hardening (SA-2026-0005) but do NOT fix the memory-safety defect - upgrading to those intermediate releases is insufficient.