A vulnerability has been found in Systerel S2OPC up to 1.7.3. (CVE-2026-78049)
A low-severity vulnerability exists in Systerel S2OPC up to version 1.7.3 in the AddNodes Service component. The flaw is an out-of-bounds read caused by improper handling of the UserAccessLevel argument in the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function. The vulnerability can be triggered remotely but requires a high degree of attack complexity. No known exploits are reported in the wild. A patch has been identified but no explicit public patch link is provided.
AI Analysis
Technical Summary
CVE-2026-78049 describes an out-of-bounds read vulnerability in Systerel S2OPC versions up to 1.7.3. The issue occurs in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within the AddNodes Service component, specifically due to manipulation of the UserAccessLevel argument. This vulnerability can be exploited remotely but demands a high level of complexity, making exploitation difficult. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Although the exploit has been publicly disclosed, no known active exploitation is reported. A patch commit identifier (aafbd37d381b618312ebdf5ddf57027f62c14fdd) is referenced, suggesting a fix is available, but no direct patch link is provided in the data.
Potential Impact
The vulnerability allows an attacker to cause an out-of-bounds read remotely, which may lead to application instability or denial of service. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 3.7 (low), reflecting limited impact and difficult exploitability.
Mitigation Recommendations
A patch addressing this vulnerability has been identified (commit aafbd37d381b618312ebdf5ddf57027f62c14fdd). It is recommended to apply this patch to affected versions of Systerel S2OPC up to 1.7.3. Since no official vendor advisory or patch link is provided, users should verify the patch availability from the official Systerel S2OPC source or repository. No additional mitigations are specified.
A vulnerability has been found in Systerel S2OPC up to 1.7.3. (CVE-2026-78049)
Description
A low-severity vulnerability exists in Systerel S2OPC up to version 1.7.3 in the AddNodes Service component. The flaw is an out-of-bounds read caused by improper handling of the UserAccessLevel argument in the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function. The vulnerability can be triggered remotely but requires a high degree of attack complexity. No known exploits are reported in the wild. A patch has been identified but no explicit public patch link is provided.
CVSS v3.1
Score 3.7low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-78049 describes an out-of-bounds read vulnerability in Systerel S2OPC versions up to 1.7.3. The issue occurs in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within the AddNodes Service component, specifically due to manipulation of the UserAccessLevel argument. This vulnerability can be exploited remotely but demands a high level of complexity, making exploitation difficult. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Although the exploit has been publicly disclosed, no known active exploitation is reported. A patch commit identifier (aafbd37d381b618312ebdf5ddf57027f62c14fdd) is referenced, suggesting a fix is available, but no direct patch link is provided in the data.
Potential Impact
The vulnerability allows an attacker to cause an out-of-bounds read remotely, which may lead to application instability or denial of service. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 3.7 (low), reflecting limited impact and difficult exploitability.
Mitigation Recommendations
A patch addressing this vulnerability has been identified (commit aafbd37d381b618312ebdf5ddf57027f62c14fdd). It is recommended to apply this patch to affected versions of Systerel S2OPC up to 1.7.3. Since no official vendor advisory or patch link is provided, users should verify the patch availability from the official Systerel S2OPC source or repository. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cq93-frxj-593v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-78049"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a8af9a6acd9273b49f32f8c
Added to database: 08/23/2026, 13:46:14 UTC
Last enriched: 08/23/2026, 13:51:50 UTC
Last updated: 08/23/2026, 22:52:13 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.