open62541 CVE-2026-82623

The History Backend plugin must be compiled in and actively configured in the open62541 deployment - specifically, the in-memory historian (ua_history_data_backend_memory) must be enabled and attached to at least one OPC UA node with historical data support. Deployments using open62541 purely as a real-time OPC UA server without any historian functionality are not exposed to this code path. No authentication is required (PR:N per CVSS 4.0 vector), meaning any network-reachable client can trigger the condition. Attack complexity is low (AC:L) with no additional attack requirements (AT:N), so no race conditions or special timing is needed. The flaw is limited to availability - it cannot be leveraged for confidentiality breach or data modification based on the provided CVSS metrics (VC:N/VI:N). Exploitation is bounded to the OPC UA network layer; if the server is not exposed to untrusted networks, risk is substantially reduced.

Real-world risk is moderate-to-low for most environments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) confirms unauthenticated network exploitation with low availability impact and no confidentiality or integrity impact - this is a crash/denial-of-service scenario, not remote code execution. The E:P modifier (exploit public) elevates urgency slightly, as the GitHub issue serves as a functional reproduction case. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantitatively assessed. No CISA KEV listing exists, meaning no confirmed in-the-wild exploitation. In ICS/OT environments where OPC UA historian availability is operationally critical, the availability impact may be more significant than the 'Low' CVSS label suggests - a crashed history backend in a production plant historian could trigger operational disruptions. The project's closure of the disclosure on procedural grounds without issuing a CVE advisory reduces confidence that a vendor-confirmed patch exists.

An unauthenticated attacker with network access to an open62541 OPC UA server that has the in-memory History Backend enabled sends a specially crafted OPC UA HistoryRead service request designed to trigger the use-after-free condition in UA_DataValue_backend_copyRange. The server process crashes or enters an undefined state, denying service to all connected OPC UA clients. The public GitHub issue at https://github.com/open62541/open62541/issues/8199 provides reproduction steps, lowering the barrier for opportunistic exploitation.