The flaw is a use‑after‑free bug located in the UA_DataValue_backend_copyRange function of the History Backend component in the open62541 OPC UA library. The bug is triggered when the function reuses memory that has already been freed, which allows a malicious client to provide crafted data that can cause the server to crash or, in some circumstances, execute unintended code. The vulnerability is exposed through the OPC UA protocol and is reported to be exploitable from a remote client. The public disclosure of the exploit indicates that attackers can reach the vulnerable code path over the network.

This vulnerability affects all builds of open62541 up to and including version 1.5.5. The open62541 library is used in applications that implement OPC UA servers or clients, so any deployment that links with a vulnerable version is at risk. The flaw resides in the history backend sub‑module, specifically in the file plugins/historydata/ua_history_data_backend_memory.c.

The CVSS base score of 6.9 reflects a moderate severity level. The EPSS score is reported as less than 1 %, indicating a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring a client that can connect to the OPC UA service. Because the exploit is publicly available, a sufficiently motivated attacker could target vulnerable systems from outside the network to induce service disruption or potentially execute code if the memory corruption leads to exploitation.