CVE-2026-67863 Details
Description
In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.
A server-side use-after-free vulnerability has been identified in open62541 version 1.5.5. The issue arises in the local MonitoredItem callback path, where the UA_Subscription_localPublish function continues to use a notification after the corresponding MonitoredItem has been deleted. This flaw allows remote attackers to cause a denial-of-service condition by triggering a heap-use-after-free error, which can lead to a server crash.
Users are advised to update to the patched version of open62541, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open62541/open62541/issues/8131 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/server.h | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_monitoreditem.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_subscription.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/issues/8131 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| open62541 | 1.5.5 (semver) 1.5.4+ |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |