# CVE-2026-67858: open62541 buffer overflow in Local Discovery Server multicast discovery

Source: https://junglewise.ai/threats/cve-2026-67858-open62541-buffer-overflow-in-local-discovery-server-multicast  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67858 · Severity: high · CVSS 7.5 · Published 2026-08-04

open62541 is an open-source OPC UA (industrial automation) server library. When configured with multicast discovery enabled, an unauthenticated attacker on the network can crash the Local Discovery Server by sending malformed registration requests with many discovery URLs, causing a denial of service that interrupts industrial control and monitoring systems.

## Quick answers

**Is CVE-2026-67858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67858 being exploited in the wild.

**How severe is CVE-2026-67858?** High severity, with a CVSS score of 7.5, published 4 August 2026.

**Which products and versions are affected?** open62541 open62541 1.5.5.

**Is there a fix for CVE-2026-67858?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67858 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67858?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in open62541 1.5.5's Local Discovery Server (LDS) when built with MDNSD multicast discovery enabled. The vulnerability is triggered when an unauthenticated remote attacker sends a RegisterServer or RegisterServer2 request containing many unique discoveryUrls, which overflow an internal buffer. The attack vector is network-accessible and requires no authentication or user interaction. Successful exploitation causes denial of service by crashing the LDS process. Patch availability for this CVE has not been confirmed from the provided information.

## Affected products

- open62541 open62541 1.5.5

## Timeline

- 2026-08-04: disclosed

## References

- [https://github.com/open62541/open62541/blob/master/doc/building.rst](https://github.com/open62541/open62541/blob/master/doc/building.rst)
- [https://github.com/open62541/open62541/blob/master/src/server/ua_discovery_mdns.c](https://github.com/open62541/open62541/blob/master/src/server/ua_discovery_mdns.c)