Heap Use-After-Free Vulnerability in open62541's TransferSubscriptions Service
CVE-2026-63035

7.2HIGH

Key Information:

Vendor

O6 Automation

Status
Open62541
Vendor
CVE Published:
30 July 2026

What is CVE-2026-63035?

A heap use-after-free vulnerability has been identified in the TransferSubscriptions service within open62541. This issue may allow an authenticated attacker to exploit the vulnerability to induce a denial of service, disrupt the service's operations, or potentially execute arbitrary code, exposing sensitive data or compromising the integrity of the system. Effective security measures are essential to mitigate potential risks.

Affected Version(s)

open62541 Windows 1.3.0 <= 1.3.17

open62541 Windows 1.4.0 <= 1.4.16

open62541 Windows 1.5.0 <= 1.5.4

References

https://www.o6-automation.com/contact
https://github.com/open62541/open62541/pull/8235/commits/...
https://github.com/open62541/open62541/pull/8236/commits/...

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA.
.