Executive brief
open62541 is an open-source OPC UA (Industrial IoT) server library widely used in industrial automation and control systems. A vulnerability in the historical data backend allows a remote attacker to trigger a memory safety bug by sending a specially crafted HistoryRead request, leading to denial of service and potential server memory corruption. Industrial systems relying on open62541 may experience crashes or undefined behavior.
Technical details
A use-after-free vulnerability exists in the UA_DataValue_backend_copyRange function (plugins/historydata/ua_history_data_backend_memory.c) in the default memory-based history backend. The function performs a shallow memcpy of a UA_DataValue structure before validating the indexRange parameter. When a crafted HistoryReadRequest with an indexRange specifying >100 dimensions is processed, UA_Variant_copyRange fails the dimension-limit check but the destination object already holds a pointer to backend-owned storage from the shallow copy. The error is incorrectly ignored by the caller, which then frees the backend storage during response cleanup. Subsequent HistoryRead requests dereference this freed heap memory, causing a use-after-free condition. The vulnerability is remotely reachable via standard OPC UA service calls and affects open62541 up to version 1.5.5.
Affected products
- open62541 open62541 up to 1.5.5
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory