Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the… (CVE-2026-67858)

CVE-2026-67858 describes a buffer overflow vulnerability in open62541 1.5.5 specifically when the Local Discovery Server is configured with multicast discovery enabled through the MDNSD backend. The vulnerability allows an unauthenticated remote attacker to send crafted RegisterServer or RegisterServer2 requests containing numerous unique discoveryUrls, which triggers a buffer overflow and results in denial of service. The CVSS 3.1 base score is 7.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

The vulnerability can be exploited remotely without authentication to cause a denial of service condition on the affected open62541 Local Discovery Server. There is no impact to confidentiality or integrity, only availability is affected.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling multicast discovery or restricting access to the Local Discovery Server to trusted networks to mitigate exposure.