EUVD-2026-52964
GHSA-jh69-g63c-w587
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated DoS with no auth required; MDNSD build requirement is a deployment condition, not an attack complexity factor; no C/I impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allows remote attackers to cause a denial of service.
AnalysisAI
Buffer overflow in open62541 1.5.5's Local Discovery Server (LDS) enables an unauthenticated remote attacker to crash the discovery service by sending a RegisterServer or RegisterServer2 request containing an abnormally large number of unique discoveryUrls, but only when the MDNSD multicast discovery backend is enabled at build time. The impact is a denial of service (A:H) with no confidentiality or integrity exposure. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis.
Technical ContextAI
open62541 is an open-source C99 implementation of the OPC UA (OPC Unified Architecture) protocol, widely used in industrial automation, ICS, and IoT environments for machine-to-machine communication. The Local Discovery Server (LDS) is an optional OPC UA component allowing servers to register themselves for client discovery. When compiled with the MDNSD (Multicast DNS Daemon) backend, the LDS supports multicast-based network discovery. The vulnerability lies in the handling of RegisterServer and RegisterServer2 service requests within ua_services_discovery.c and ua_discovery_mdns.c (both referenced in the advisory). Supplying an excessive count of unique discoveryUrls in a single request triggers a buffer overflow in the URL accumulation logic. CWE classification was not populated by the reporter, but the described behavior is consistent with CWE-120 (Classic Buffer Overflow) or CWE-787 (Out-of-bounds Write). The CPE string provided (cpe:2.3:a:n/a:n/a) is unpopulated and not usable for automated detection; version 1.5.5 is the only version explicitly cited as affected.
RemediationAI
No vendor-released patch with a confirmed fixed version has been identified from the available data - references point to the GitHub issue and source files rather than a tagged release or official security advisory. Organizations should monitor https://github.com/open62541/open62541/issues/8094 for upstream patch availability. As an immediate compensating control, disable MDNSD multicast discovery at build time if it is not operationally required, which eliminates this attack surface entirely; OPC UA clients can be directed to use static discovery endpoint URLs instead. If multicast discovery must remain enabled, restrict network access to the OPC UA discovery port (typically UDP/TCP 4840) using firewall rules or network ACLs to limit exposure to trusted internal segments, preventing unauthenticated external access to the LDS. In ICS/OT environments, placing the LDS behind a DMZ or network zone with strict ingress filtering reduces remote exploitation risk without requiring a rebuild. Each compensating control carries trade-offs: disabling MDNSD breaks automatic discovery for OPC UA clients relying on it; port filtering may interfere with legitimate discovery workflows.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today