CVE-2026-67855

CVE-2026-67855 is a use-after-free in open62541's GDS (Global Discovery Server) PushManagement feature, which handles distributed certificate lifecycle management in OPC UA networks. The vulnerability exists in code that is only compiled when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled—a compile-time flag that places this functionality in a structural blind spot. If you're running open62541 in production, check your build configuration: the vulnerable code path only exists in binaries compiled with this flag enabled. The use-after-free occurs in the certificate push workflow, where objects are freed at one checkpoint but async callbacks or deferred operations elsewhere in the state machine still hold references that fire after the memory has been deallocated. This is a classic temporal invariant failure in distributed PKI state machines—one of the most notoriously difficult patterns to get right because certificate updates involve multi-phase lifecycle management (initiation, approval, push, installation, revocation) with asynchronous operations that outlive their originating context. The EPSS score of 0.0029 indicates no active exploitation currently, but this should not reassure you if you've enabled this feature. Users who compile in GDS PushManagement are precisely those running distributed OPC UA networks with centralized certificate management—production OT infrastructure, not test beds. The vulnerability becomes most dangerous in the deployment profile where it was enabled. The structural issue here isn't just that optional code gets less review; it's that certificate lifecycle management in security-critical infrastructure is a domain where compile-time optionality creates an ownership vacuum: the core team doesn't exercise it daily, users who enable it assume it's production-ready, and neither party maintains the temporal invariant reasoning it requires. Review your build logs for UA_ENABLE_GDS_PUSHMANAGEMENT. If enabled, evaluate whether you can disable it while maintaining your operational requirements, or plan for a patch update. If you must keep it, monitor for worker thread crashes correlated with certificate push operations—they may indicate exploitation of this memory safety defect. The deeper remediation should include formal analysis of the PushManagement state machine for async boundary safety, not just the immediate null-check or reference-count fix.

Reviewed through automated stages and approved by a human before publication.