CVE-2026-82623: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-82623 is a server-side heap use-after-free vulnerability in the UA_DataValue_backend_copyRange function within the History Backend component (plugins/historydata/ua_history_data_backend_memory.c) of open62541, an open-source OPC UA implementation. It affects open62541 versions 1.5.0 through 1.5.5 and can be triggered remotely by an unauthenticated attacker. The vulnerability was reported via a GitHub issue on July 16, 2026, and publicly disclosed on August 31, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is a use-after-free (CWE-416) combined with improper memory buffer handling (CWE-119) in the private backend helper UA_DataValue_backend_copyRange(). The function performs a shallow memcpy of the entire UA_DataValue struct — including ownership-relevant UA_Variant fields such as data, type, and arrayDimensions — before calling UA_Variant_copyRange(). When an attacker sends a crafted HistoryReadRequest with an indexRange containing 101 dimensions (exceeding UA_MAX_ARRAY_DIMS = 100), UA_Variant_copyRange() fails on the dimension-limit check, but the destination object already holds an alias to the backend-owned pointer. Critically, the caller copyDataValues_backend_memory() ignores the failure return code, increments the result counter, and returns UA_STATUSCODE_GOOD — causing the invalid, partially-constructed object to be embedded in the response. During response cleanup, the server frees the backend-owned historical storage; a subsequent normal HistoryRead then dereferences the resulting dangling pointer, triggering the heap-use-after-free. A public proof-of-concept client tool (wc_client_history_indexrange_uaf) and full ASan crash trace are available in the GitHub issue (GitHub Issue).

Successful exploitation causes the OPC UA server to crash (remote denial of service) due to the heap-use-after-free condition, rendering the service unresponsive to legitimate clients. There is no demonstrated confidentiality or integrity impact — the CVSS scoring reflects availability impact only. In industrial and IIoT environments where open62541 is commonly deployed, service disruption can have significant operational consequences, particularly for systems relying on OPC UA for real-time data acquisition or process control (Github Advisory, GitHub Issue).

A public proof-of-concept exploit client (PoC.zip) was included in the original GitHub issue report, making this vulnerability weaponizable by low-skilled attackers. Exploitation requires no authentication, no user interaction, and no special privileges — only network access to the OPC UA service port (default TCP 4840). The EPSS score is 0.0 at time of publication, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date. The open62541 project closed the issue report, noting it was not submitted through the official security disclosure process (GitHub Issue, Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible OPC UA servers running open62541 versions 1.5.0–1.5.5 with historizing enabled, using tools like Shodan (search for opc.tcp on port 4840) or network scanners.
2. Establish OPC UA connection: Connect to the target OPC UA server using any standard OPC UA client library (e.g., open62541 client, python-opcua) over opc.tcp://<target>:4840.
3. Craft malicious HistoryReadRequest: Construct a HistoryReadRequest targeting a historized node and set the indexRange field to a syntactically valid but structurally extreme value with 101 dimensions (e.g., 0,0,0,0,... repeated 101 times, producing a string of length ~201 characters).
4. Send the crafted request: Transmit the malicious request to the server. The server's UA_NumericRange_parse() accepts the input, and the request is processed through Service_HistoryRead → readRaw_service_default → copyDataValues_backend_memory → UA_DataValue_backend_copyRange. The shallow memcpy aliases the backend pointer, UA_Variant_copyRange() fails silently, and the server returns UA_STATUSCODE_GOOD.
5. Trigger the use-after-free: Send a subsequent normal HistoryReadRequest to the same node. The server attempts to deep-copy the backend value that was freed during the previous response cleanup, triggering the heap-use-after-free and causing the server process to crash.
6. Observe denial of service: The OPC UA server becomes unresponsive; the attacker-side client receives BadSecureChannelClosed on the follow-up request, confirming server-side crash (GitHub Issue).

• Network: Unexpected OPC UA HistoryReadRequest messages on TCP port 4840 containing indexRange strings with an unusually large number of comma-separated dimension values (e.g., 100+ dimensions, string length ~200+ characters); repeated connection attempts from the same source IP followed by connection drops.
• Logs: OPC UA server logs showing a HistoryRead service call returning Good status immediately followed by server process termination or restart; application crash logs referencing ua_history_data_backend_memory.c or UA_DataValue_backend_copyRange.
• Process: Unexpected termination or restart of the open62541 server process (e.g., tutorial_server_historicaldata or any custom OPC UA server binary); AddressSanitizer output referencing heap-use-after-free at UA_Array_copy / Variant_copy / DataValue_copy if ASan is enabled.
• File System: Presence of core dump files generated by the OPC UA server process crash in the working directory or system core dump location (GitHub Issue).

The recommended remediation is to update open62541 to a version later than 1.5.5 once a patched release is available; a patch has been acknowledged via GitHub Advisory GHSA-w6p5-54jx-cmmh (added 2026-08-31). As a workaround, implement network access controls (firewall rules, VPN, allowlisting) to restrict access to the OPC UA service port (TCP 4840) from untrusted or unauthenticated network sources. Disabling the historizing feature (UA_ENABLE_HISTORIZING=OFF) in deployments that do not require it eliminates the vulnerable code path entirely. Monitor for abnormal OPC UA server crashes or service unavailability as an indicator of exploitation attempts (Github Advisory, GitHub Issue).

The open62541 project maintainers closed the original GitHub issue (#8199) without a formal fix, stating that the reporter did not use the official security vulnerability disclosure process (SECURITY.md). This response drew implicit criticism, as a detailed technical write-up with full ASan evidence and a PoC client was publicly available in the issue before closure. The vulnerability was subsequently catalogued by VulDB, ENISA (EUVD-2026-68367), INCIBE-CERT, and the GitHub Advisory Database, indicating broader community awareness despite the project's initial handling (GitHub Issue, Github Advisory).