CVE-2026-67857 in open62541
Summary
by MITRE • 08/05/2026
open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The open62541 library version 1.5.5 contains a critical out-of-bounds read vulnerability within its client-side implementation that poses significant security risks to industrial automation systems relying on OPC UA communication protocols. This flaw exists specifically in the responseReadNamespacesArray() function located in the src/client/ua_client_connect.c source file, representing a fundamental memory access violation that can be exploited by malicious actors to compromise system integrity and availability.
This vulnerability stems from improper bounds checking during the processing of namespace array responses received from OPC UA servers during client connection establishment. The out-of-bounds read occurs when the client attempts to access memory locations beyond the allocated buffer boundaries while parsing namespace information returned by the server. Such behavior violates fundamental security principles and creates opportunities for attackers to execute arbitrary code or cause denial of service conditions. The vulnerability is particularly concerning given that open62541 is widely deployed in industrial control systems, building automation, and other critical infrastructure environments where OPC UA protocol compliance is essential.
The operational impact of this vulnerability extends beyond simple memory corruption, as it enables potential attackers to leverage the out-of-bounds read for more sophisticated exploitation techniques. An attacker who successfully triggers this condition could potentially cause the client application to crash or exhibit unpredictable behavior, leading to service disruption in industrial environments where continuous operation is critical. Additionally, the vulnerability aligns with CWE-129, which specifically addresses improper validation of array indices, making it a well-documented weakness that has been previously exploited in similar industrial control system scenarios. The attack surface is particularly relevant in environments where OPC UA clients communicate with potentially untrusted servers or when network traffic is not properly secured.
Mitigation strategies for this vulnerability should prioritize immediate patching of affected systems to version 1.5.6 or later, which contains the necessary fixes for the bounds checking implementation. Organizations should implement network segmentation and access controls to limit exposure of OPC UA client applications to untrusted networks, aligning with ATT&CK technique T1046 for network service scanning and T1210 for exploitation of remote services. Additional defensive measures include implementing proper input validation at multiple layers, deploying intrusion detection systems to monitor for anomalous OPC UA traffic patterns, and conducting comprehensive security assessments of industrial control system environments. The vulnerability demonstrates the importance of rigorous memory safety practices in embedded systems and industrial protocols where reliability and security are paramount considerations for operational technology environments.