What is the CVSS score of CVE-2026-67862?

CVE-2026-67862 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of open62541 are affected by CVE-2026-67862?

open62541 OPC UA client library version 1.5.5 contains a buffer overflow that crashes client processes when reading responses from malicious or compromised OPC UA servers, creating availability risk…

How to fix or mitigate CVE-2026-67862?

Within 24 hours, identify all applications and production systems using open62541 1.5.5 and restrict OPC UA client network access to pre-approved internal servers only; isolate client processes from untrusted external OPC UA sources using firewall rules or network segmentation. Within 7 days, contact Prosys OPC and open62541 maintainers to confirm patch timeline; begin testing upgrades to open62541 2.x releases and document application dependencies blocking migration. Within 30 days, either deploy the upgraded open62541 library version to all affected systems or implement compensating controls (containerization, mutual TLS, crash monitoring) as interim protection while patch availability is clarified.

open62541 CVE-2026-67862

EUVD-2026-52996 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-04 cve@mitre.org

GHSA-vqxw-7v8h-rvf2

Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-delivered malicious server response requires no attacker authentication; impact is crash-only with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 19:23 vuln.today

CVSS changed

Aug 05, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Aug 04, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 22:17 cve.org

HIGH 7.5

DescriptionCVE.org

open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. This allows a remote attacker to cause a denial of service.

AnalysisAI

Buffer overflow in open62541 1.5.5's client-side high-level attribute reading logic crashes OPC UA client processes when handling maliciously crafted server responses, resulting in denial of service. The flaw resides in src/client/ua_client_highlevel.c and is reachable whenever a client built on open62541 1.5.5 reads node attributes from an attacker-controlled or compromised OPC UA server. No public exploit code has been identified and EPSS at 0.21% (11th percentile) reflects low current exploitation probability; no CISA KEV listing.

Technical ContextAI

open62541 is a widely adopted open-source OPC UA (Unified Architecture) protocol stack written in C, used in industrial automation, SCADA systems, PLCs, and IoT gateways. The vulnerable component is src/client/ua_client_highlevel.c, the high-level client API layer that abstracts node attribute read operations over the OPC UA binary protocol. When the client issues a ReadRequest and processes the server's ReadResponse, the attribute parsing logic in this file fails to adequately bound a buffer, triggering the overflow. Notably, the assigned CWE is CWE-400 (Uncontrolled Resource Consumption) rather than CWE-120 or CWE-122 (Buffer Copy/Heap-Based Buffer Overflow), which is inconsistent with the description's explicit mention of a buffer overflow; the root cause class is therefore not definitively confirmed by the available metadata alone. The affected surface is the OPC UA client side - exploitation is server-initiated, delivered to the connecting client.

RemediationAI

The primary remediation is to upgrade open62541 beyond version 1.5.5; however, no specific patched release version is confirmed in the available data. The fix status must be tracked directly via the GitHub issue at https://github.com/open62541/open62541/issues/8139 and the open62541 release page before upgrading, as only an upstream issue report - not a tagged release - has been referenced. As a compensating control for environments that cannot immediately patch, restrict OPC UA client connections exclusively to a static allowlist of trusted, network-isolated OPC UA server endpoints, preventing clients from reaching attacker-operated servers. Enforce this at the network firewall layer by limiting outbound OPC UA traffic (default TCP port 4840) to known server IPs only. Monitor OPC UA client process crashes or unexpected restarts as a potential exploitation indicator. Note: network-layer controls do not eliminate risk if a trusted server is itself compromised.