Stefan Profanter

12 exploits Active since Aug 2026
CVE-2026-67863 WRITEUP HIGH WRITEUP
open62541 1.5.5 - Use-After-Free in Local MonitoredItem Callback Path
In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.
CVSS 7.5
CVE-2026-67864 WRITEUP WRITEUP
open62541 < 1.5.6 - Denial of Service via NodeManagement Type-Instantiation Logic
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component
CVE-2026-67870 WRITEUP WRITEUP
open62541 < 1.5.6 - Remote NULL Pointer Dereference via Crafted AddReferencesRequest
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
CVE-2026-67863 WRITEUP HIGH WRITEUP
open62541 1.5.5 - Use-After-Free in Local MonitoredItem Callback Path
In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.
CVSS 7.5
CVE-2026-67870 WRITEUP WRITEUP
open62541 < 1.5.6 - Remote NULL Pointer Dereference via Crafted AddReferencesRequest
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
CVE-2026-67863 WRITEUP HIGH WRITEUP
open62541 1.5.5 - Use-After-Free in Local MonitoredItem Callback Path
In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.
CVSS 7.5
CVE-2026-67864 WRITEUP WRITEUP
open62541 < 1.5.6 - Denial of Service via NodeManagement Type-Instantiation Logic
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component
CVE-2026-67869 WRITEUP HIGH WRITEUP
open62541 < 1.5.6 - Denial of Service via Buffer Overflow in Service_Call Input Argument Validation
Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata
CVSS 7.5
CVE-2026-67870 WRITEUP WRITEUP
open62541 < 1.5.6 - Remote NULL Pointer Dereference via Crafted AddReferencesRequest
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
CVE-2026-67856 WRITEUP ANALYSIS PENDING WRITEUP
open62541 < 1.5.6 - Denial of Service via Crafted OPC UA Subscription Requests
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests
CVE-2026-67859 WRITEUP HIGH WRITEUP
open62541 1.5.5 - Remote Denial of Service via Discovery/LDS Handling
Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.
CVSS 7.5
CVE-2026-67862 WRITEUP ANALYSIS PENDING WRITEUP
open62541 1.5.5 - Denial of Service via Buffer Overflow in High-Level Attribute Reading Logic
open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. This allows a remote attacker to cause a denial of service.