A vulnerability was identified in Systerel S2OPC up to 1.7.3. (CVE-2026-82619)

CVE-2026-82619 describes a use-after-free vulnerability in Systerel S2OPC versions up to 1.7.3. The vulnerable code is located in the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result within src/ClientServer/services/bgenc/subscription_mgr.c. Manipulation of the EventFilter argument leads to use-after-free, which can be exploited remotely. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). An exploit is publicly available, but no known exploitation in the wild has been reported. A patch exists identified by commit a4cee16a851b971be447a6ed531173702c722b99, and applying it is considered best practice.

The vulnerability allows remote attackers to cause a use-after-free condition, potentially leading to denial of service or other impacts affecting availability. The CVSS v3.1 base score is 4.3 (low severity), reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, and impact limited to availability only. There is no reported impact on confidentiality or integrity. No known active exploitation has been observed.

A patch identified by commit a4cee16a851b971be447a6ed531173702c722b99 is available and should be applied to affected versions of Systerel S2OPC to remediate this vulnerability. Since the vendor advisory or patch links are not explicitly provided, users should verify the patch availability from the official Systerel S2OPC repository or vendor channels. No alternative mitigations are specified.