CVE-2026-82623: Use After Free in open62541

The open62541 library up to version 1.5.5 contains a use-after-free vulnerability in the function UA_DataValue_backend_copyRange located in plugins/historydata/ua_history_data_backend_memory.c. This vulnerability allows remote attackers to manipulate memory after it has been freed, potentially leading to undefined behavior or crashes. The vulnerability is identified as CWE-416 (Use After Free) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code exists, but the project has not officially acknowledged this as a security vulnerability through their preferred reporting process. No official patch or remediation has been linked or confirmed.

Successful exploitation of this use-after-free vulnerability could allow remote attackers to cause a denial of service or potentially execute arbitrary code due to memory corruption. The vulnerability does not require authentication or user interaction, increasing its risk. However, the medium CVSS score (6.9) reflects that the impact is limited to local memory corruption without confirmed privilege escalation or confidentiality impact. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published by the open62541 project as of the provided data. Users should monitor the official open62541 channels for updates and consider applying any future patches promptly. Until a fix is available, consider restricting network access to the affected component to reduce exposure.