Description

A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T07:17:46.747Z",
  "pubdate": "2026-08-31T07:17:46.747Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability has been identified in the open62541 library, specifically impacting the History Backend component.\nThe vulnerability resides within the UA_DataValue_backend_copyRange function located in plugins/historydata/ua_history_data_backend_memory.c.\nThis flaw allows a remote attacker to trigger memory corruption, potentially leading to arbitrary code execution or a denial-of-service state.\nThe vulnerability affects all open62541 versions up to and including 1.5.5.\nThe exposure is critical as the attack can be executed remotely without specific user interaction, and public exploit material exists.\nGiven the nature of OPC UA implementations, this vulnerability poses a significant risk to industrial automation and control systems relying on this library for data history management.\nDefensive posture requires immediate attention to memory management practices within the affected module, as the project maintainers have indicated current reports did not follow formal security disclosure channels.",
  "technicalDetails": "The vulnerability is a classic Use-After-Free (UAF) condition located in the UA_DataValue_backend_copyRange function within the history data backend of the open62541 stack.\nThe root cause involves improper memory lifecycle management when handling data value ranges. During the copy operation, the function fails to maintain proper ownership or reference counting of the underlying memory buffers, leading to a scenario where a pointer is accessed after the memory it references has been explicitly freed.\nThe vulnerability is triggered during remote manipulation of historical data queries. An attacker can craft malicious OPC UA requests that interact with the history backend, specifically targeting operations that utilize range copying. By sending a carefully sequenced request, an attacker forces the application to deallocate a memory block while a dangling pointer remains active in the processing context.\nWhen the UA_DataValue_backend_copyRange function subsequently dereferences the dangling pointer to perform data access or copying, the system accesses memory that may have been repurposed, overwritten, or unmapped. If the memory is repurposed, the application may read sensitive information from other operations or, more critically, perform an unauthorized write operation.\nThe attack flow proceeds as follows: 1) The attacker initiates an OPC UA session with an endpoint utilizing the history data backend. 2) The attacker submits a request triggering the execution of UA_DataValue_backend_copyRange. 3) The memory management logic within this function incorrectly releases the target memory while the program state still maintains a valid reference to it. 4) The attacker sends a second request or orchestrates heap grooming to populate the previously freed memory location with controlled data. 5) The application uses the dangling pointer, triggering the UAF condition with attacker-controlled content, facilitating control flow hijacking.\nThe affected component is the History Backend (plugins/historydata/ua_history_data_backend_memory.c), which is often compiled into OPC UA servers that provide historical data logging. Because this occurs within the library logic, any implementation linking against the vulnerable version of open62541 is susceptible.\nThe impact includes service instability (crash) or potential remote code execution (RCE) depending on the heap layout and the ability to influence memory contents surrounding the freed allocation."
}