A critical null pointer dereference vulnerability in open62541 version 1.5.5 permits unauthenticated remote attackers to cause severe system instability or potential code execution.

The vulnerability resides in the server side AddReferences implementation, where incomplete validation of non-local ExpandedNodeId targets allows an unauthenticated attacker to supply a crafted request that leaves a target node pointer as NULL during execution.

The CVSS score of 9.8 reflects a critical severity, indicating that this flaw poses a significant risk to the availability and integrity of systems utilizing the open62541 stack. Successful exploitation could lead to total service disruption, denial of service, or potential remote code execution, which may result in unauthorized data access or complete compromise of the host environment.

Immediate Action: Since a specific patch version is currently unavailable, users should isolate affected systems from public networks and restrict access to trusted internal sources only.

Proactive Monitoring: Security teams should monitor server logs for unusual AddReferencesRequest patterns or repeated service crashes that may indicate exploitation attempts.

Compensating Controls: Deploy strict network filtering and utilize an intrusion detection system to monitor for malformed OPC UA traffic targeting the server.

Public Exploit Available: Unknown.

Given the critical nature of this vulnerability and the existence of a proof-of-concept, organizations must treat this as a high priority. Administrators should restrict network access to vulnerable instances immediately and coordinate with the open62541 project maintainers to track the release of a security update. Continuous vigilance and monitoring of traffic logs are essential until a formal patch is applied.