CVE-2026-67870 Details
Description
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
A server-side NULL pointer dereference vulnerability has been identified in open62541 version 1.5.5. The issue arises in the AddReferences service, where incomplete validation of non-local ExpandedNodeId targets allows a remote attacker to send a crafted AddReferencesRequest. By leaving the targetServerUri empty and setting a non-zero targetNodeId.serverIndex, the request bypasses initial checks, causing the target node pointer to remain NULL. This NULL pointer is then dereferenced during execution, leading to a crash.
The vulnerability can be fixed by updating the AddReferences implementation to properly validate the locality of ExpandedNodeId targets before processing the request. This involves rejecting non-local targets consistently and ensuring that the targetNode is valid before dereferencing it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open62541/open62541/issues/8172 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/types.h | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_nodemanagement.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/blob/v1.5.5/src/ua_types.c | [email protected] | Source CodeVendor |
| https://github.com/open62541/open62541/issues/8172 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| open62541 | v1.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |