Is CVE-2026-67860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67860 being exploited in the wild.

How severe is CVE-2026-67860?

High severity, with a CVSS score of 7.5, published 4 August 2026.

Which products and versions are affected?

open62541 open62541 1.5.5 and master branch (commit 10022ffbcc92d823be4c51dd96cfd350f8e351e7).

Is there a fix for CVE-2026-67860?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67860 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67860?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67860: open62541 heap buffer overflow in HistoryRead continuation point handling

CVE-2026-67860 · Severity: high · CVSS 7.5 · Published 2026-08-04

open62541 is an open-source OPC UA server library used to expose industrial control systems and data historians over a network. A remote attacker can trigger a heap buffer overflow by sending a forged HistoryRead request with a malicious continuation point, causing the server to crash and become unavailable. The vulnerability requires the server to have historization enabled and use the default memory-backed history database.

Quick answers

Is CVE-2026-67860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67860 being exploited in the wild.
How severe is CVE-2026-67860?: High severity, with a CVSS score of 7.5, published 4 August 2026.
Which products and versions are affected?: open62541 open62541 1.5.5 and master branch (commit 10022ffbcc92d823be4c51dd96cfd350f8e351e7).
Is there a fix for CVE-2026-67860?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67860 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67860?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a heap-based buffer overflow in the default HistoryRead path (ua_history_database_default.c and ua_history_data_backend_memory.c). The vulnerability stems from a size_t underflow when an attacker-controlled skip value in a HistoryRead continuation point exceeds the internal result size. The outer layer allocates a small buffer based on the clamped result size, but then passes a very large (wrapped) valueSize to the backend copy function, which writes far more entries than the allocated buffer can hold. The attack is remotely reachable via the normal TCP HistoryRead service without authentication. Confirmed impact is remote denial of service (server crash); code execution has not been demonstrated.

Affected products

open62541 open62541 1.5.5 and master branch (commit 10022ffbcc92d823be4c51dd96cfd350f8e351e7)

Timeline

2026-08-04: disclosed: Published on NVD

References

https://github.com/open62541/open62541/issues/8091

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.