This vulnerability is a heap use-after-free issue (CWE-416) in the TransferSubscriptions service of open62541, an open-source OPC UA implementation by o6 Automation. The flaw allows an authenticated attacker to trigger a use-after-free condition, which can lead to denial of service or potentially arbitrary code execution. The affected versions explicitly include 1.3.0, 1.4.0, and 1.5.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. There is no vendor advisory or patch information available at this time.

An authenticated attacker exploiting this vulnerability could cause denial of service or potentially execute arbitrary code on the affected system. This could disrupt operations relying on open62541 and compromise system integrity and availability. Confidentiality is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the TransferSubscriptions service to trusted authenticated users only and monitor for unusual activity related to this service.