CVE-2026-67863

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-67863", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-08-07T12:53:10.651Z", "dateReserved": "2026-07-30T00:00:00.000Z", "datePublished": "2026-08-05T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T22:05:42.076Z"}, "descriptions": [{"lang": "en", "value": "In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/open62541/open62541/issues/8131"}, {"url": "https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/server.h"}, {"url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_subscription.c"}, {"url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_monitoreditem.c"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "references": [{"url": "https://github.com/open62541/open62541/issues/8131", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T12:45:26.712174Z", "id": "CVE-2026-67863", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T12:53:10.651Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67863", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:45:26.712174Z"}}}], "references": [{"url": "https://github.com/open62541/open62541/issues/8131", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T12:45:42.888Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/open62541/open62541/issues/8131"}, {"url": "https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/server.h"}, {"url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_subscription.c"}, {"url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_monitoreditem.c"}], "descriptions": [{"lang": "en", "value": "In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T22:05:42.076Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67863", "state": "PUBLISHED", "dateUpdated": "2026-08-07T12:53:10.651Z", "dateReserved": "2026-07-30T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-05T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service."}], "id": "CVE-2026-67863", "lastModified": "2026-08-31T19:33:11.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67863", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T12:45:26.712174Z", "version": "2.0.3"}}]}, "published": "2026-08-05T23:16:53.753", "references": [{"source": "cve@mitre.org", "url": "https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/server.h"}, {"source": "cve@mitre.org", "url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_monitoreditem.c"}, {"source": "cve@mitre.org", "url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_subscription.c"}, {"source": "cve@mitre.org", "url": "https://github.com/open62541/open62541/issues/8131"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open62541/open62541/issues/8131"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "open62541: open62541: Denial of Service via use-after-free vulnerability", "id": "2511847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511847"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.", "A flaw was found in open62541. A server-side use-after-free vulnerability exists in the local MonitoredItem callback path. This occurs when the system attempts to use a notification object after it has been deallocated. A remote attacker can exploit this vulnerability to cause a denial of service (DoS), making the affected system unavailable."], "name": "CVE-2026-67863", "public_date": "2026-08-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-67863\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67863\nhttps://github.com/open62541/open62541/blob/v1.5.5/include/open62541/server.h\nhttps://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_monitoreditem.c\nhttps://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_subscription.c\nhttps://github.com/open62541/open62541/issues/8131"], "statement": "This Important flaw in open62541 allows a remote attacker to trigger a denial of service due to a use-after-free vulnerability in the server's MonitoredItem callback path. The issue arises from improper handling of notification objects after deallocation, leading to service unavailability. This is considered Important due to the potential for unauthenticated remote denial of service against affected open62541 server instances.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.5.5"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "open62541", "vendor": "open62541"}], "created": "2026-08-05T23:30:04.392242+00:00", "updated": "2026-08-07T14:45:03.073364+00:00", "vendors": ["open62541", "open62541$PRODUCT$open62541"]}