CVE-2026-67858
7.5 HIGHpublic exploit availablePublished 2026-08-04 · Updated 2026-08-05
AI risk analysis
- Summary
- A buffer overflow vulnerability in open62541 1.5.5 allows unauthenticated remote attackers to cause a denial of service by sending malformed RegisterServer or RegisterServer2 requests.
- Exploitability
- Exploitation is relatively easy due to the lack of authentication and the specific nature of the request needed, requiring multicast discovery enabled through MDNSD backend.
- Blast radius
- If exploited, it could lead to a denial of service for affected systems, impacting availability and potentially disrupting operations relying on open62541.
- Prioritized remediation
- Downgrade to a version prior to 1.5.5 or apply the available patch if one is released, disable multicast discovery in the Local Discovery Server configuration, or update to a newer version of open62541 that addresses this vulnerability.
dosmulticastmdnsddiscoveryremote
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allows remote attackers to cause a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-120
Public exploit & PoC references
- https://github.com/open62541/open62541/blob/master/doc/building.rst
- https://github.com/open62541/open62541/blob/master/src/server/ua_discovery_mdns.c
- https://github.com/open62541/open62541/blob/master/src/server/ua_services_discovery.c
- https://github.com/open62541/open62541/issues/8094
- https://github.com/open62541/open62541/tree/master/examples/discovery
- https://github.com/open62541/open62541/issues/8094
All references
- https://github.com/open62541/open62541/blob/master/doc/building.rst
- https://github.com/open62541/open62541/blob/master/src/server/ua_discovery_mdns.c
- https://github.com/open62541/open62541/blob/master/src/server/ua_services_discovery.c
- https://github.com/open62541/open62541/issues/8094
- https://github.com/open62541/open62541/tree/master/examples/discovery
- https://github.com/open62541/open62541/issues/8094
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.