S2OPC versions up to 1.7.3 contain a null pointer dereference vulnerability in the msg_subscription_publish_bs__alloc_notification_message_items() function. The flaw arises because a failed memory allocation for DataChangeNotification is overwritten by a subsequent successful allocation for EventNotificationList. Attackers can exploit this by triggering heap allocation failures on sessions that handle both data-change and event notifications, leading to server process termination.

The vulnerability can cause the S2OPC server process to terminate unexpectedly, resulting in denial of service. There is no indication of confidentiality or integrity impact. The CVSS score is 5.3 (medium severity), reflecting the denial of service impact with network attack vector, high attack complexity, and low privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configurations that combine data-change and event notifications in sessions or monitor for conditions that might trigger heap allocation failures. No official fix or patch links are provided in the current data.