Threats affecting pkg:github/systerel/S2OPC

CVE-2026-90782 is a medium severity vulnerability in Systerel S2OPC up to version 1.7.3. It involves a null pointer dereference in the function msg_subscription_publish_bs__alloc_notification_message_items(). This occurs when a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList, allowing attackers to trigger heap allocation failures. Exploitation can cause the server process to terminate, resulting in a denial of service.

CVE-2026-78049 is an out-of-bounds read vulnerability in Systerel S2OPC versions 1.7.0 through 1.7.3. It occurs in the AddNodes Service component, specifically in the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function. The vulnerability is triggered by manipulation of the UserAccessLevel argument. Exploitation requires a high degree of complexity and can be initiated remotely. A patch identified by commit aafbd37d381b618312ebdf5ddf57027f62c14fdd is available to address this issue. The CVSS 4.0 base score is 6.3, indicating medium severity.

CVE-2026-67867 is a buffer overflow vulnerability in Systerel S2OPC version 1.7.3. It allows a remote attacker to cause a denial of service by exploiting the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data. The vulnerability has a high severity with a CVSS score of 7.5. No patch or official remediation has been confirmed yet.

CVE-2026-67866 is a buffer overflow vulnerability in Systerel S2OPC version 1.7.3. It allows a remote attacker to cause a denial of service via specific client wrapper functions related to deleting monitored items. The vulnerability has a high severity score of 7.5 and does not impact confidentiality or integrity but affects availability.

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.