Description
open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. This allows a remote attacker to cause a denial of service.
Published: 2026-08-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a buffer‑overflow in the high‑level attribute reading logic of open62541 1.5.5, allowing a remote attacker to cause a denial of service. This flaw maps to a classic stack‑based buffer overflow (CWE‑120) and also may lead to resource exhaustion (CWE‑400).

Affected Systems

The affected system is the open62541 OPC UA client library version 1.5.5. No other vendor or product versions are listed.

Risk and Exploitability

Based on the description, it is inferred that an attacker can trigger the flaw by sending a crafted request without needing authentication, which may crash the application and disrupt service. The EPSS score is < 1 %, indicating a small but non‑zero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The CVSS score of 7.5 indicates high severity.

Generated by OpenCVE AI on August 5, 2026 at 20:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade open62541 to version 1.5.6 or later when the fix is released.
  • If patching is delayed, restrict network access to the OPC UA server exposing open62541 to trusted hosts only.
  • Monitor logs for repeated failures or abnormal memory usage that might indicate exploitation attempts.

Generated by OpenCVE AI on August 5, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121

Wed, 05 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Open62541 High-Level Attribute Reading Causing DoS open62541: open62541: Denial of Service via buffer-overflow
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Wed, 05 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Open62541 High-Level Attribute Reading Causing DoS
Weaknesses CWE-121

Tue, 04 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Open62541
Open62541 open62541
Vendors & Products Open62541
Open62541 open62541

Tue, 04 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. This allows a remote attacker to cause a denial of service.
References

Subscriptions

Open62541 Open62541
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-05T18:29:29.087Z

Reserved: 2026-07-30T00:00:00.000Z

Link: CVE-2026-67862

cve-icon Vulnrichment

Updated: 2026-08-05T18:29:24.617Z

cve-icon NVD

Status : Received

Published: 2026-08-04T22:17:16.597

Modified: 2026-08-05T19:17:34.047

Link: CVE-2026-67862

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-04T00:00:00Z

Links: CVE-2026-67862 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T20:30:06Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-400

    Uncontrolled Resource Consumption