open62541 Subscription Use-After-Free Remote Code Execution Vulnerability

November 13th, 2026
ZDI-26-990 ZDI-CAN-30231

CVE ID

CVE-2026-126962

CVSS Score

8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

open62541

Affected Products

open62541

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of open62541. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of subscriptions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the service account.

Additional Details

https://github.com/open62541/open62541/commit/2da371bcdaadeb23051635a60e38f31039af9fd8, https://github.com/open62541/open62541/commit/bc30df3adab5cc61383cb7e7f551bfd6f7ac160c


Disclosure Timeline

  • 2026-06-17 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Andrew Letourneau

Back to Advisories