CVE-2026-67863

HIGH

open62541 1.5.5 - Use-After-Free in Local MonitoredItem Callback Path

Title source: llm

Description

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.

References (4)

Core 4

Core References

https://github.com/open62541/open62541/issues/8131

https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/server.h

View Writeup ZIP pw:eip

https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_subscription.c

View Writeup ZIP pw:eip

https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_monitoreditem.c

View Writeup ZIP pw:eip

Scores

CVSS v3 7.5

EPSS 0.0041

EPSS Percentile 33.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-416

Status published

Published Aug 05, 2026

Tracked Since Aug 06, 2026