CVE-2026-67858 open62541 CVE debrief

Who should care

Organizations using open62541 1.5.5 with multicast discovery enabled, as well as security teams responsible for monitoring and patching vulnerabilities in industrial control systems and IoT devices, should prioritize patching to prevent potential denial of service attacks. Additionally, operators of affected systems, platform administrators, and vulnerability management teams should review and apply patches or mitigations to prevent exploitation.

Technical summary

A buffer overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls to cause a denial of service. This vulnerability affects systems using open62541 1.5.5 with multicast discovery enabled, particularly in industrial control systems and IoT devices. Defenders should review the official CVE record, NVD entry, and open62541 documentation for multicast discovery and MDNSD backend configurations to verify affected scope and severity.

Defensive priority

Organizations using open62541 1.5.5 with multicast discovery enabled should prioritize patching to prevent potential denial of service attacks.

Recommended defensive actions

• Review and apply patches for open62541 1.5.5
• Disable multicast discovery if not required
• Monitor for suspicious RegisterServer or RegisterServer2 requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide evidence of a buffer overflow vulnerability in open62541 1.5.5. However, details about affected configurations and potential mitigations are limited. To verify, defenders should review the official CVE record, NVD entry, and open62541 documentation for multicast discovery and MDNSD backend configurations. Additional evidence may be required to confirm affected scope and severity.

Official resources