CVE-2026-67856 Details

A denial-of-service vulnerability has been identified in open62541 versions through 1.5.5. The issue allows remote attackers to disrupt server operations by sending crafted requests that manipulate subscription and monitored item management processes. The vulnerability arises from a flaw in the subscription transfer implementation, which fails to properly manage the back-pointers of sampling monitored items, leading to a heap-use-after-free condition. This memory corruption can cause server crashes and session terminations, exacerbating the denial-of-service impact.

Users can manually patch the vulnerability by modifying the subscription transfer logic to avoid shallow copies that include intrusive list back-pointers. Instead, the transfer process should rebuild the sampling item links to point to the new subscription, ensuring that no stale pointers remain that could lead to memory corruption.