A buffer overflow exists in the Local Discovery Server of open62541 version 1.5.5 when multicast discovery is enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request that contains a large number of unique discoveryUrls. The internal buffer of the discovery service overflows, which causes the server process to crash and results in a denial of service. The flaw does not provide a direct code‑execution path, but it allows an attacker to disrupt the availability of the OPC UA server.

The vulnerability affects installations of open62541 that use version 1.5.5 and have the Local Discovery Server compiled with multicast discovery via the MDNSD backend. Any server instance exposed to external networks and configured to accept discovery registration requests is potentially impacted.

The CVSS score of 7.5 indicates a high risk of exploitation, though the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. An attacker can likely reach the vulnerable service remotely over the network, send a crafted RegisterServer request with an excessive number of URLs, and cause the server process to terminate. The lack of authentication or size limits on the discoveryUrls field makes the exploit straightforward in environments that enable the feature.