Description
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
Published: 2026-08-05
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Open62541 version 1.5.5 contains an incomplete validation flaw in the server‑side AddReferences implementation for non‑local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non‑zero targetNodeId.serverIndex, causing an internal pointer to remain NULL while the server continues processing. This null pointer dereference results in the server process crashing or terminating unexpectedly, leading to a denial of service. The weakness maps to CWE‑476.

Affected Systems

The vulnerable product is the open62541 open‑source OPC UA library, version 1.5.5. No other vendors or product variants are listed in the advisory.

Risk and Exploitability

The flaw is exploitable remotely over the network. Although the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, the presence of a NULL pointer dereference combined with missing input validation presents a high potential for service disruption. The CVSS score of 9.8 indicates a high severity. Current risk is moderate to high until an official patch or mitigation is applied.

Generated by OpenCVE AI on August 6, 2026 at 17:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the open62541 library to a version that includes proper validation for non‑local ExpandedNodeId targets (the fix was documented for issue 8172).
  • If an immediate upgrade is not feasible, reconfigure the OPC UA server to disable the AddReferences service or restrict its use to authenticated, trusted clients only.
  • Deploy network controls to filter or block AddReferences requests that contain an empty targetServerUri or a non‑zero targetNodeId.serverIndex.

Generated by OpenCVE AI on August 6, 2026 at 17:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 06 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Incomplete Validation in AddReferences Causing Null Pointer Dereference in open62541 open62541: open62541: Denial of Service via incomplete validation in AddReferences
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Thu, 06 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Incomplete Validation in AddReferences Causing Null Pointer Dereference in open62541
Weaknesses CWE-476

Thu, 06 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Open62541
Open62541 open62541
Vendors & Products Open62541
Open62541 open62541

Wed, 05 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Description In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
References

Subscriptions

Open62541 Open62541
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-06T15:54:03.899Z

Reserved: 2026-07-30T00:00:00.000Z

Link: CVE-2026-67870

cve-icon Vulnrichment

Updated: 2026-08-06T15:53:55.160Z

cve-icon NVD

Status : Received

Published: 2026-08-06T00:16:54.043

Modified: 2026-08-06T22:18:23.353

Link: CVE-2026-67870

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-05T00:00:00Z

Links: CVE-2026-67870 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T17:45:03Z

Weaknesses