What is the CVSS score of CVE-2026-67869?

CVE-2026-67869 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of open62541 are affected by CVE-2026-67869?

open62541 OPC UA server library version 1.5.5 is vulnerable to denial-of-service attacks affecting operational technology infrastructure through unauthenticated network access; no vendor patch is…

How to fix or mitigate CVE-2026-67869?

Within 24 hours: Identify all systems running open62541 v1.5.5 or earlier versions and verify whether they are exposed to untrusted network ingress; prioritize network containment since no vendor-released patch identified at time of analysis. Within 7 days: Implement network segmentation to restrict OPC UA service ports (typically 4840/tcp) to only trusted control-system traffic; establish monitoring for abnormal connection attempts and buffer overflow signatures. Within 30 days: Identify and evaluate upgrade paths to alternative versions of open62541 if released by the vendor, or plan migration to alternative OPC UA implementations; document any legacy systems unable to upgrade and implement enhanced monitoring controls.

open62541 CVE-2026-67869

EUVD-2026-53682 HIGH

Classic Buffer Overflow (CWE-120)

2026-08-05 mitre

GHSA-86h5-5qfw-5vr9

Buffer Overflow Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable OPC UA port, no authentication in default/anonymous mode, DoS-only impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 23:51 vuln.today

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata

AnalysisAI

Denial-of-service via buffer overflow in open62541 v1.5.5 allows a remote, unauthenticated attacker to crash an OPC UA server by sending a crafted Service_Call request with malformed input arguments. The flaw resides in the method-call service handler (ua_services_method.c), where input arguments are validated against runtime-resolved InputArguments metadata without proper bounds enforcement. No active exploitation or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful availability risk for any OPC UA server deployment based on this library version.

Technical ContextAI

open62541 is an open-source, ANSI C99 implementation of the OPC UA (Open Platform Communications Unified Architecture) protocol stack, widely adopted in industrial automation, SCADA, and IIoT environments. The vulnerability exists in the Service_Call handler located in src/server/ua_services_method.c (v1.5.5). When a remote client invokes a server-side method, the handler resolves the method's InputArguments node at runtime and validates the caller-supplied argument array against it. A buffer overflow occurs during this validation step, indicating that the length or content of attacker-supplied arguments is not safely bounded before memory operations. The related reference to ua_subscription_alarms_conditions.c suggests the alarm/condition subsystem may share or exercise the same code path. No CWE has been formally assigned by NVD, but the described behavior is consistent with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) or CWE-120 (Buffer Copy without Checking Size of Input). The CPE data provided is listed as n/a, which is a data quality gap - the actual affected product is open62541 v1.5.5 as identified by the library's own GitHub repository references.

RemediationAI

The primary remediation is to upgrade beyond open62541 v1.5.5 once a patched release is issued by the project maintainers; no specific fixed version number is confirmed in the available data (patch available per vendor/upstream disclosure, released version not independently confirmed). Administrators should monitor the open62541 GitHub releases page and the linked issue (https://github.com/open62541/open62541/issues/8171) for a fix. As an immediate compensating control, restrict network access to the OPC UA server port (typically TCP 4840) using firewall rules or network segmentation to trusted clients only - this eliminates the remote attack surface while a patch is prepared, at the trade-off of reducing legitimate remote access. If the deployment uses OPC UA security modes, enforcing SignAndEncrypt with certificate-based authentication may reduce the unauthenticated attack surface, though it does not eliminate the flaw if authenticated method calls also trigger the vulnerable path. Disabling OPC UA method-call functionality entirely (if not operationally required) removes the vulnerable code path but may break dependent client integrations.