Junglewise Threat Intelligence

CVE-2026-63035: o6 Automation open62541 use-after-free in TransferSubscriptions service

CVE-2026-63035 · Severity: high · CVSS 8.1 · Published 2026-07-30

Executive brief

open62541 is an open-source implementation of OPC UA, a communication protocol used extensively in industrial automation and Internet of Things (IoT) environments. A security flaw in the way it handles subscription transfers could allow a logged-in attacker to crash the service or potentially run unauthorized code. This could lead to a loss of control over industrial equipment, operational downtime, or a breach of the system's integrity.

Technical details

A heap use-after-free vulnerability exists within the TransferSubscriptions service of the open62541 OPC UA library. The flaw is triggered when the service improperly manages memory during the transfer of subscriptions between sessions, allowing an authenticated attacker to reference memory that has already been freed. This can be exploited via network requests to cause a crash (Denial of Service) or potentially achieve arbitrary code execution. The vulnerability affects multiple stable branches including 1.3.x, 1.4.x, and 1.5.x, as well as the master branch. Fixes have been developed and submitted as pull requests to the project's repository.

Affected products

  • o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch

Timeline

  • 2026-07-30: advisory: NVD and ICS-CERT published the advisory.
  • 2026-07-23: patched: Fixes merged into 1.3 and 1.4 branches.
  • 2026-07-24: patched: Fixes merged into 1.5 branch.

References