CVE-2026-67857 identifies an out-of-bounds read in open62541 version 1.5.5 specifically in the client-side function responseReadNamespacesArray() in the source file src/client/ua_client_connect.c. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and has a CVSS 3.1 base score of 7.5, indicating high severity. The attack complexity is low, no privileges or user interaction are required, and the impact is limited to availability without confidentiality or integrity loss. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker to cause an out-of-bounds read in the client application, potentially leading to application crashes or denial of service. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding use of open62541 version 1.5.5 in contexts where untrusted data is processed or apply other risk mitigation strategies as appropriate.