What is the CVSS score of CVE-2026-67863?

CVE-2026-67863 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of open62541 are affected by CVE-2026-67863?

open62541 1.5.5 contains a use-after-free vulnerability that allows remote attackers to crash OPC UA server instances, disrupting availability of industrial automation and IoT systems.

How to fix or mitigate CVE-2026-67863?

Within 24 hours: identify and catalog all systems running open62541 1.5.5 across production and development environments through software inventory and network scanning. Within 7 days: implement network segmentation to restrict OPC UA traffic to trusted sources, deploy connection monitoring to detect abnormal subscription patterns, and assess upgrade feasibility to versions beyond 1.5.5 if available. Within 30 days: establish continuous logging of subscription-related failures in OPC UA servers, develop and test rapid restart procedures and failover automation, and request patch status confirmation from open62541 maintainers.

open62541 CVE-2026-67863

EUVD-2026-53671 HIGH

Use After Free (CWE-416)

2026-08-05 mitre

GHSA-j8g3-2qjc-25x2

Denial Of Service N A Memory Corruption Use After Free

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AC:H because triggering the UAF requires a specific server-side callback pattern (self-deletion during localPublish), not a universally default condition.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 23:06 vuln.today

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.

AnalysisAI

Server-side use-after-free in open62541 1.5.5 allows a remote attacker to crash an OPC UA server process, causing denial of service. The flaw arises in the local MonitoredItem subscription path where UA_Subscription_localPublish continues dereferencing a UA_Notification object after a callback has already freed it by calling UA_Server_deleteMonitoredItem on the active item. No public exploit or CISA KEV listing has been identified; impact is limited to availability with no confidentiality or integrity exposure.

Technical ContextAI

open62541 is an open-source C implementation of the OPC UA (IEC 62541) standard, widely used in industrial IoT, SCADA, and manufacturing automation systems. The vulnerability resides in the subscription and MonitoredItem subsystem (ua_subscription.c and ua_services_monitoreditem.c, both pinned to v1.5.5 in the source references). OPC UA supports 'local' MonitoredItems - subscriptions created programmatically within the server process itself, not by remote OPC UA clients. When UA_Subscription_localPublish iterates over pending notifications and invokes a MonitoredItem callback, the callback may call UA_Server_deleteMonitoredItem for the item currently being processed. This frees the associated UA_Notification object, but localPublish retains a stale pointer to it and continues accessing freed memory - a textbook use-after-free (CWE not formally assigned by NVD, but this maps to CWE-416: Use After Free). The CPE data provided by NVD is listed as cpe:2.3:a:n/a:n/a which is uninformative; the affected product and version are confirmed directly by the upstream issue tracker and source file references.

RemediationAI

No patched version of open62541 is explicitly identified in the available references - the upstream issue tracker (github.com/open62541/open62541/issues/8131) and the source file links do not reference a fix commit or tagged release. Operators should monitor that issue tracker and upgrade to a patched release as soon as one is available. As a compensating control, restrict network access to OPC UA server ports (default TCP 4840) using host-based or network-layer firewall rules, limiting connections to trusted clients only; this reduces the remote attack surface but does not eliminate the underlying flaw. Review server-side code for any MonitoredItem callbacks that call UA_Server_deleteMonitoredItem on the item being currently processed, and refactor such patterns to defer deletion until after the callback returns. In OT/ICS environments where availability is critical, consider placing the OPC UA server behind a protocol-aware industrial DMZ or data diode where feasible.