CVE-2026-63035

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63035
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63035.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63035
Downstream
Published
2026-07-30T21:56:04.345Z
Modified
2026-07-31T11:45:35.536616273Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
o6 Automation open62541 Use After Free
Details

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

Database specific 
{
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63035.json",
    "cna_assigner": "icscert",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "master"
                },
                {
                    "last_affected": "master"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/open62541/open62541

Affected ranges

Type
GIT
Repo
https://github.com/open62541/open62541
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
41f4deef34a9d0f94fcb830e2c831a9eb6236ade
Introduced
84347820c8550b5750f2cd581c14ab201611c579
Last affected
f63e2a819aff6e468242dc2e54ccbd5b75d63654
Introduced
b90fbfac5ef484089447bf5e3fe6ad7baaaebada
Last affected
dfd44a234645ed29cc6d190048bc8ae80c5454cd
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.3.0"
        },
        {
            "last_affected": "1.3.17"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.16"
        },
        {
            "introduced": "1.5.0"
        },
        {
            "last_affected": "1.5.4"
        }
    ]
}

Affected versions

Other
basic256sha256
prev-v1.*
prev-v1.4.2
v0.*
v0.0.0-150309
v0.1-automation14
v0.1.0-RC1
v0.1.0-RC4
v0.2.0-RC1
v1.*
v1.0-dev
v1.0-rc3
v1.1
v1.1-dev
v1.1-rc1
v1.2-rc1
v1.3
v1.3-rc1
v1.3-rc2
v1.3-rc2-ef
v1.3-rc2-ef2
v1.3.1
v1.3.10
v1.3.11
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.17
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.11.1
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.16
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63035.json"