CVE-2026-67860 Details
Description
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.
A heap-based buffer overflow vulnerability has been identified in open62541 version 1.5.5. The issue arises in the default HistoryRead service when the memory backend is used with the default history database. The vulnerability allows a remote client to manipulate the continuation point skip value, leading to an out-of-bounds write in the server's memory. This issue is reproducible on the official example server that handles historical data.
A minimal fix has been suggested, which involves rejecting invalid skip values before processing and ensuring that the backend does not copy more data than what has been allocated. This patch can be applied directly to the ua_history_database_default.c file.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open62541/open62541/issues/8091 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/open62541/open62541/issues/8091 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| open62541 | 1.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |