CVE-2026-67870: Null Pointer Dereference

Published Aug 5, 2026

Updated

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.

Affected Software

1 affected component

open62541 open62541=1.5.5

Event History

Aug 5, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Aug 6, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-67870?

CVE-2026-67870 has a risk score of 65, indicating a medium severity vulnerability.

How do I fix CVE-2026-67870?

To fix CVE-2026-67870, upgrade to a patched version of open62541 that addresses the incomplete validation flaw.

What type of attack is possible with CVE-2026-67870?

CVE-2026-67870 allows a remote attacker to exploit an incomplete validation flaw in the AddReferences implementation.

What software is affected by CVE-2026-67870?

CVE-2026-67870 affects open62541 version 1.5.5.

What does the incomplete validation in CVE-2026-67870 refer to?

The incomplete validation in CVE-2026-67870 refers to the failure to properly validate non-local ExpandedNodeId targets in AddReferences requests.