CVE-2026-63035 in open62541
Summary
by MITRE • 07/31/2026
A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The heap use-after-free vulnerability in the TransferSubscriptions service of open62541 represents a critical security flaw that can be exploited by authenticated attackers to compromise system integrity and availability. This vulnerability resides within the OPC UA stack implementation, specifically targeting the subscription transfer functionality that allows clients to move subscriptions between different sessions. The issue manifests when the application fails to properly manage memory references after objects have been freed from heap memory, creating opportunities for malicious actors to manipulate program execution flow through carefully crafted requests.
The technical root cause of this vulnerability stems from improper memory management within the TransferSubscriptions service implementation where allocated heap memory is not correctly invalidated or reinitialized after object deallocation. When an attacker successfully authenticates and sends a malformed TransferSubscriptions request, the application may continue to reference freed memory locations, leading to unpredictable behavior including potential code execution or system crashes. This type of vulnerability falls under CWE-416 which specifically addresses use-after-free conditions in software implementations, making it particularly dangerous as it can be leveraged for both denial of service and remote code execution attacks depending on the attack surface and system configuration.
From an operational perspective, this vulnerability presents significant risks to industrial control systems and IoT deployments that rely on open62541 for OPC UA communications. The authenticated nature of the exploit means that attackers must first establish valid credentials, but once achieved, they can potentially disrupt critical operations or gain unauthorized access to sensitive system resources. The impact extends beyond simple service interruption as the use-after-free condition could be exploited through the attacker-controlled memory references to inject malicious code into running processes, particularly when combined with other exploitation techniques such as return-oriented programming or heap spraying approaches. This vulnerability directly relates to ATT&CK technique T1059 which covers execution through command and script interpreters, as well as T1486 for data manipulation and system compromise.
Organizations utilizing open62541 should implement immediate mitigations including upgrading to patched versions of the software where available, implementing network segmentation to limit access to OPC UA services, and establishing strict authentication controls to reduce the attack surface. Additional protective measures include monitoring for suspicious TransferSubscriptions request patterns, implementing robust input validation for all OPC UA service calls, and deploying intrusion detection systems that can identify anomalous behavior indicative of exploitation attempts. The vulnerability also highlights the importance of memory safety practices in industrial communication protocols and reinforces the need for comprehensive security testing including fuzzing and formal verification approaches to identify similar issues in complex protocol implementations.