CVE-2026-67858 in open62541
Summary
by MITRE • 08/05/2026
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allows remote attackers to cause a denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability under discussion represents a critical buffer overflow condition within the open62541 1.5.5 implementation specifically when configured with multicast discovery capabilities through the MDNSD backend. This issue manifests in the Local Discovery Server component which serves as a crucial element for OPC UA network discovery and server registration processes. The flaw occurs during processing of RegisterServer or RegisterServer2 requests that contain an excessive number of unique discoveryUrls, creating a scenario where memory boundaries are exceeded during buffer operations.
The technical implementation involves the MDNSD backend's handling of incoming registration requests where multiple discoveryUrl entries are processed without adequate bounds checking or input validation. When an attacker crafts malicious requests containing numerous unique discoveryUrls, the system attempts to allocate memory buffers that cannot accommodate the excessive data volume, leading to stack or heap corruption. This buffer overflow condition directly violates the fundamental security principle of input validation and proper memory management as outlined in CWE-121 and CWE-122 categories.
From an operational perspective, this vulnerability presents a significant denial of service threat that can be exploited by unauthenticated remote attackers without requiring any privileged access or credentials. The attack vector is particularly concerning because it leverages the standard OPC UA discovery mechanisms that are typically enabled in industrial automation environments where open62541 is commonly deployed. The impact extends beyond simple service disruption as the buffer overflow could potentially enable more sophisticated attacks if the system does not properly handle memory corruption conditions, making this a critical concern for industrial control systems and IoT deployments.
The mitigation strategies should focus on immediate configuration changes to disable multicast discovery when not required, implementing proper input validation with maximum URL limits, and applying code-level patches that enforce bounds checking on discoveryUrl arrays. Organizations should also consider network segmentation to limit exposure of LDS components and implement monitoring solutions to detect anomalous registration patterns. This vulnerability aligns with ATT&CK technique T1203 which covers the exploitation of software vulnerabilities for denial of service, while also demonstrating characteristics of T1499 related to network denial of service attacks. The issue highlights the importance of proper memory management in industrial communication protocols and underscores the need for security considerations in embedded systems where OPC UA implementations are prevalent.