A server‑side use‑after‑free flaw exists in open62541 version 1.5.5. The bug is triggered when the UA_Subscription_localPublish routine continues to reference a UA_Notification after a monitored‑item callback calls UA_Server_deleteMonitoredItem for that same local monitored item. After the callback returns, the next step in publish attempts to access memory that has already been freed, which can cause the server to crash or become unresponsive, resulting in a denial of service. The flaw does not provide any remote code execution or persistence capabilities.

The affected product is the open62541 OPC UA server, specifically the 1.5.5 release. No additional versions or vendors are listed as impacted.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is unavailable, and the flaw is not currently listed in the CISA KEV catalog. Attackers can remotely trigger the flaw by sending a crafted OPC UA request that leads the server to delete a monitored item during a publish cycle. Because the issue resides in the local callback path, a successful exploitation will crash or halt the OPC UA server, denying service to legitimate clients. The likelihood of exploitation is moderated by the need for a specifically timed request and a vulnerable server; however, the impact of a successful attack is complete service disruption.