A server‑side use‑after‑free flaw, identified as CWE-416 and CWE-825, exists in the open62541 OPC UA server version 1.5.5. The bug is triggered when UA_Subscription_localPublish continues to reference a UA_Notification after a monitored‑item callback calls UA_Server_deleteMonitoredItem for that same local monitored item. After the callback returns, the next step in publish attempts to access memory that has already been freed, which can cause the server to crash or become unresponsive, resulting in a denial of service. The flaw does not provide any remote code execution or persistence capabilities.

The affected product is the open62541 OPC UA server, specifically the 1.5.5 release. No additional versions or vendors are listed as impacted.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of < 1% suggests a very low but non‑zero probability that the flaw will be exploited in the wild, and the issue is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can remotely trigger the flaw by sending a crafted OPC UA request that leads the server to delete a monitored item during a publish cycle. Because the issue resides in the local callback path, a successful exploitation will crash or halt the OPC UA server, denying service to legitimate clients. The likelihood of exploitation is moderated by the need for a specifically timed request and a vulnerable server; however, the impact of a successful attack is complete service disruption.