Read the docs
TI-2026-61689 Aliases CVE-2026-90782GHSA-wj27-rfm4-9hp4

S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

Priority MEDIUM 60CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0057 47th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SysterelS2OPCup to 1.7.3—Patch availableCNA
  • S2OPC VendorSysterel Affected up to 1.7.3 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90782
  2. 2026-10-03 Alias added: GHSA-wj27-rfm4-9hp4

References

Patch 2

Other 3

  • TI-2026-54290 Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds CVSS 4.0MEDIUM 6.3
  • TI-2026-56960 Systerel S2OPC subscription_mgr.c use after free CVSS 4.0MEDIUM 5.3
  • TI-2026-56959 Systerel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-bounds CVSS 4.0MEDIUM 5.3
  • TI-2026-15394 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds CVSS 4.0MEDIUM 4.8
  • TI-2026-08554 Improper Certificate Validation in S2OPC CVSS 3.1HIGH 7.3
  • TI-2026-15010 Improper Certificate Validation in S2OPC CVSS 3.1MEDIUM 5.6
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences