CVE-2026-67855 in Open62541
Summary
by MITRE • 08/05/2026
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The open62541 library presents a critical heap use-after-free vulnerability within its Global Discovery and Selection (GDS) PushManagement certificate update workflow when the UA_ENABLE_GDS_PUSHMANAGEMENT compilation flag is active. This flaw exists in the implementation of secure communication protocols for industrial automation systems that rely on OPC UA standards. The vulnerability manifests during certificate management operations where memory allocated for certificate handling is freed from the heap but subsequently accessed by the application logic, creating a potential exploitation vector for remote attackers.
The technical nature of this vulnerability stems from improper memory management within the GDS PushManagement subsystem, which handles automated certificate updates for OPC UA servers. When certificate update requests are processed through the push management workflow, the system allocates memory for certificate data structures and processing buffers. However, the cleanup routine fails to properly invalidate pointers or reset memory states before freeing allocated heap space. A remote attacker can trigger this condition by sending specially crafted certificate update messages that cause the system to free memory segments while other processes may still reference them, leading to unpredictable behavior including application crashes or potential code execution.
The operational impact of this vulnerability extends beyond simple denial of service conditions as it compromises the integrity of industrial communication systems relying on open62541 for OPC UA implementations. Organizations using this library in critical infrastructure environments face potential disruptions to their automation workflows, particularly in scenarios where certificate rotation occurs automatically without manual intervention. The vulnerability affects systems that depend on secure certificate management for maintaining trusted connections between industrial devices and supervisory control systems. Attackers could exploit this weakness to repeatedly crash services, causing operational downtime that may result in production losses or safety concerns in industrial environments.
Mitigation strategies should focus on immediate codebase updates from the open62541 maintainers who have addressed this specific memory management issue in recent releases. Organizations should disable UA_ENABLE_GDS_PUSHMANAGEMENT compilation flag if automatic certificate push management is not required, effectively disabling the vulnerable code path. Additionally, network segmentation and access controls should be implemented to limit exposure of OPC UA services to untrusted networks. Security monitoring should include detection of abnormal certificate update patterns that may indicate exploitation attempts. The vulnerability aligns with CWE-416 which describes use-after-free conditions, and maps to ATT&CK technique T1059 for remote code execution through service manipulation. System administrators should also consider implementing intrusion detection systems capable of identifying anomalous certificate management activities that could indicate exploitation attempts against this specific vulnerability.