CVE-2026-67857

This CVE exposes a flaw in how open62541 handles responses during the OPC UA client handshake — specifically in responseReadNamespacesArray(), which parses namespace data sent by a remote server. The out-of-bounds read occurs because the client assumes server-provided namespace arrays are well-formed, without validating length fields or array bounds before reading. This is a trust boundary violation: the client treats data from an external server as if it came from a trusted source. The practical risk extends beyond the information disclosure the CVSS 7.5 captures. In industrial deployments, OPC UA clients are persistent, networked, and auto-reconnect with session state preservation. A malicious server can trigger this vulnerability on every reconnect cycle — not a one-shot attack but a repeatable trigger. Worse, clients typically aggregate multiple server connections. If one server is adversarial, the compromised client instance then has trust relationships with legitimate servers, creating lateral movement potential that the CVSS score alone doesn't capture. The supply chain dimension amplifies this. open62541 is a library used by downstream industrial software. A vulnerable version ships to end users through those dependencies before the CVE reaches their radar. Patch quickly, but also audit your deployment topology: are any clients configured to connect to discovery servers or untrusted endpoints? If so, treat those connection paths as hostile input surfaces. Implement connection validation and consider explicit bounds-checking wrappers around client handshake parsing even if the library patch is applied — the architectural assumption that server responses are trusted is the deeper problem.

Reviewed through automated stages and approved by a human before publication.