A high-severity heap-based buffer overflow in open62541 version 1.5.5 allows unauthenticated attackers to cause a denial of service via the HistoryRead path.

The vulnerability is a heap-based buffer overflow triggered within the default HistoryRead functionality of the open62541 library. It requires no authentication to trigger, as indicated by the network attack vector and low attack complexity.

The primary impact of this vulnerability is a denial of service, which can disrupt critical industrial communication processes relying on OPC UA. Given the CVSS score of 7.5, the risk to system availability is significant, potentially impacting operational uptime and reliability in production environments.

Immediate Action: Review the official open62541 GitHub repository for updates and apply the latest available version that addresses the heap-based buffer overflow in the HistoryRead path.

Proactive Monitoring: Monitor system logs for unusual crashes or service interruptions related to the open62541 library, particularly during HistoryRead operations.

Compensating Controls: If a patch is not immediately available, restrict network access to the affected OPC UA services to trusted IP addresses only, and implement rate limiting on requests to mitigate potential automated exploitation.

Public Exploit Available: Unknown

Organizations utilizing open62541 version 1.5.5 must prioritize an investigation into their deployment to determine if the vulnerable HistoryRead path is active. Given the identified proof-of-concept, administrators should apply updates as soon as they are made available by the maintainers and ensure that network-level defenses are in place to limit exposure.