Executive brief
open62541 is an open-source implementation of the OPC Unified Architecture (OPC UA) protocol, a widely-used industrial control system communication standard. A memory safety flaw in the Global Discovery Server (GDS) PushManagement certificate update feature allows a remote attacker to trigger a denial of service by crashing the server, disrupting operational technology environments that depend on OPC UA for equipment communication.
Technical details
The vulnerability is a heap use-after-free (CWE-416) in the GDS PushManagement certificate update workflow that occurs only when the UA_ENABLE_GDS_PUSHMANAGEMENT compile-time flag is enabled. A remote attacker can exploit this memory corruption issue over the network to trigger a crash, resulting in denial of service. The flaw affects the proper lifecycle management of heap-allocated objects during certificate update operations. No patch availability information is provided in the advisory; affected versions must be identified from the vendor's release history.
Affected products
- open62541 open62541 <UNKNOWN>
Timeline
- 2026-08-04: disclosed