Is CVE-2026-67861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67861 being exploited in the wild.

How severe is CVE-2026-67861?

High severity, with a CVSS score of 7.5, published 4 August 2026.

Which products and versions are affected?

open62541 open62541 1.5.5 and before.

Is there a fix for CVE-2026-67861?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67861 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67861?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67861: open62541 stack overflow in UA_Client_getRemoteDataTypes

CVE-2026-67861 · Severity: high · CVSS 7.5 · Published 2026-08-04

open62541 is a widely-used OPC UA client library used in industrial automation and control systems. A malicious OPC UA server can exploit an unbounded recursive traversal in the data type discovery function to exhaust the client's call stack, crashing the client application. This denial-of-service attack is triggered during normal protocol operations after a complete handshake and session setup, making it a practical risk for any system using this library to connect to untrusted servers.

Quick answers

Is CVE-2026-67861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67861 being exploited in the wild.
How severe is CVE-2026-67861?: High severity, with a CVSS score of 7.5, published 4 August 2026.
Which products and versions are affected?: open62541 open62541 1.5.5 and before.
Is there a fix for CVE-2026-67861?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67861 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67861?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack overflow caused by unbounded recursion in the `browseDataTypesRecursive()` helper function within `UA_Client_getRemoteDataTypes()`. When automatically discovering remote custom data types, the client recursively walks the OPC UA type hierarchy by following `HasSubtype` references without any depth limit, node budget, or iterative work queue. A malicious server can return a syntethic chain of previously unseen `DataType` subtypes in successive `Browse` responses, causing the client to recurse indefinitely. The only protection—a visited-node tree keyed by `NodeId`—fails to prevent this attack because the attacker can supply a fresh `NodeId` at each recursion level. The vulnerability is triggered through the official public API `UA_Client_getRemoteDataTypes()` with default parameters, as demonstrated by the vulnerable official example in `examples/custom_datatype/client_types_custom.c`. No patch is confirmed available.

Affected products

open62541 open62541 1.5.5 and before

Timeline

2026-08-04: disclosed
2026-08-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.