# CVE-2026-82623: open62541 use-after-free in history backend

Source: https://junglewise.ai/threats/cve-2026-82623-open62541-use-after-free-in-history-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82623 · Severity: medium · CVSS 5.3 · Published 2026-08-31

open62541 is an open-source OPC UA (Industrial IoT) server library widely used in industrial automation and control systems. A vulnerability in the historical data backend allows a remote attacker to trigger a memory safety bug by sending a specially crafted HistoryRead request, leading to denial of service and potential server memory corruption. Industrial systems relying on open62541 may experience crashes or undefined behavior.

## Quick answers

**Is CVE-2026-82623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82623 being exploited in the wild.

**How severe is CVE-2026-82623?** Medium severity, with a CVSS score of 5.3, published 31 August 2026.

**Which products and versions are affected?** open62541 open62541 up to 1.5.5.

**Is there a fix for CVE-2026-82623?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82623 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82623?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the UA_DataValue_backend_copyRange function (plugins/historydata/ua_history_data_backend_memory.c) in the default memory-based history backend. The function performs a shallow memcpy of a UA_DataValue structure before validating the indexRange parameter. When a crafted HistoryReadRequest with an indexRange specifying >100 dimensions is processed, UA_Variant_copyRange fails the dimension-limit check but the destination object already holds a pointer to backend-owned storage from the shallow copy. The error is incorrectly ignored by the caller, which then frees the backend storage during response cleanup. Subsequent HistoryRead requests dereference this freed heap memory, causing a use-after-free condition. The vulnerability is remotely reachable via standard OPC UA service calls and affects open62541 up to version 1.5.5.

## Affected products

- open62541 open62541 up to 1.5.5

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: advisory

## References

- [https://github.com/open62541/open62541/](https://github.com/open62541/open62541/)
- [https://github.com/open62541/open62541/issues/8199](https://github.com/open62541/open62541/issues/8199)