Medium severity · published Aug 31, 2026
CVE-2026-82623
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
open62541 · Open62541
1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82623
github.com
https://github.com/open62541/open62541/
github.com
https://github.com/open62541/open62541/issues/8199
vuldb.com
https://vuldb.com/cve/CVE-2026-82623
vuldb.com
https://vuldb.com/submit/893207
vuldb.com
https://vuldb.com/vuln/397123
vuldb.com
https://vuldb.com/vuln/397123/cti
More from open62541
8.1
CVE-2026-116014
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
7.5
CVE-2024-53429
Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash
7.5
CVE-2022-25761
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks…
5.5
CVE-2020-36429
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth
5.3
CVE-2026-18785
o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free