# CVE-2026-67861: open62541 stack overflow in UA_Client_getRemoteDataTypes

Source: https://junglewise.ai/threats/cve-2026-67861-open62541-stack-overflow-in-ua-client-getremotedatatypes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67861 · Severity: high · CVSS 7.5 · Published 2026-08-04

open62541 is a widely-used OPC UA client library used in industrial automation and control systems. A malicious OPC UA server can exploit an unbounded recursive traversal in the data type discovery function to exhaust the client's call stack, crashing the client application. This denial-of-service attack is triggered during normal protocol operations after a complete handshake and session setup, making it a practical risk for any system using this library to connect to untrusted servers.

## Quick answers

**Is CVE-2026-67861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67861 being exploited in the wild.

**How severe is CVE-2026-67861?** High severity, with a CVSS score of 7.5, published 4 August 2026.

**Which products and versions are affected?** open62541 open62541 1.5.5 and before.

**Is there a fix for CVE-2026-67861?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67861 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67861?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack overflow caused by unbounded recursion in the `browseDataTypesRecursive()` helper function within `UA_Client_getRemoteDataTypes()`. When automatically discovering remote custom data types, the client recursively walks the OPC UA type hierarchy by following `HasSubtype` references without any depth limit, node budget, or iterative work queue. A malicious server can return a syntethic chain of previously unseen `DataType` subtypes in successive `Browse` responses, causing the client to recurse indefinitely. The only protection—a visited-node tree keyed by `NodeId`—fails to prevent this attack because the attacker can supply a fresh `NodeId` at each recursion level. The vulnerability is triggered through the official public API `UA_Client_getRemoteDataTypes()` with default parameters, as demonstrated by the vulnerable official example in `examples/custom_datatype/client_types_custom.c`. No patch is confirmed available.

## Affected products

- open62541 open62541 1.5.5 and before

## Timeline

- 2026-08-04: disclosed
- 2026-08-04: advisory

## References

- [https://github.com/open62541/open62541/issues/8140](https://github.com/open62541/open62541/issues/8140)
- [https://raw.githubusercontent.com/open62541/open62541/v1.5.5/examples/custom_datatype/client_types_custom.c](https://raw.githubusercontent.com/open62541/open62541/v1.5.5/examples/custom_datatype/client_types_custom.c)