CVE-2026-67857 Details
Description
open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.
A client-side out-of-bounds read vulnerability has been identified in open62541 version 1.5.5. The issue arises in the function responseReadNamespacesArray() within the file ua_client_connect.c. This vulnerability allows a malicious OPC UA TCP server to crash the open62541 client during the standard connection handshake, specifically after the session has been activated. The vulnerability is triggered when the client automatically reads the Server_NamespaceArray. If the server responds with an empty results array, the client misinterprets this as a valid pointer, leading to an invalid memory access and a crash.
A patch has been suggested that involves adding structural validation to the NamespaceArray ReadResponse before dereferencing the results. This patch should be applied to the open62541 client library.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open62541/open62541/issues/8104 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/gff-cw/information/issues/9 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://github.com/open62541/open62541/blob/v1.5.5/examples/client_connect.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/examples/client_connect_loop.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/src/client/ua_client_connect.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/issues/8104 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| open62541 | 1.5.5 (semver) |
CPE
Remediation
| |
| open62541 examples/client_connect | All versions |
CPE
Remediation
| |
| open62541 examples/client_connect_loop | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |