CVE-2026-78049 in S2OPC
Summary
by MITRE • 08/23/2026
A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/23/2026
The Systerel S2OPC library, specifically versions up to 1.7.3, contains a critical memory safety vulnerability within its OPC UA implementation that poses significant risks to systems relying on secure industrial communication protocols. The flaw resides in the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function located in the src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c file. This component is integral to the AddNodes service, which handles the creation and configuration of nodes within an OPC UA address space. When a client requests to add a variable node with specific attributes, particularly those involving access control settings, the internal helper function processes these inputs without adequate bounds checking on the UserAccessLevel argument. This lack of validation allows for an out-of-bounds read operation when the provided value exceeds expected limits or falls outside valid enumeration ranges defined by the library's internal logic.
From a technical perspective, this vulnerability is classified as CWE-125: Out-of-Bounds Read, which occurs when software reads data from memory locations beyond the intended buffer boundaries. In the context of S2OPC, an attacker can craft a malicious OPC UA request that sets the UserAccessLevel attribute to a value that triggers this erroneous read condition. Because the vulnerability is triggered during the processing of incoming network requests for node creation, it allows for remote exploitation without requiring prior authentication in certain configurations where anonymous access or weak authentication policies are enabled. The complexity of exploiting this flaw is considered high due to the need to precisely manipulate memory states and potentially bypass other security controls such as firewalls or intrusion detection systems that monitor OPC UA traffic patterns. However, despite the difficulty, the existence of a public exploit means that threat actors with moderate capabilities can leverage this vulnerability for reconnaissance or further exploitation attempts.
The operational impact of this out-of-bounds read is primarily centered on information disclosure and potential service instability. By reading memory beyond the allocated buffer, an attacker may be able to leak sensitive data stored in adjacent memory locations, such as internal pointers, configuration details, or other node attributes that could aid in subsequent attacks. In some scenarios, depending on how the operating system handles page faults for out-of-bounds reads, this could lead to application crashes resulting in a denial of service against the OPC UA server endpoint. While immediate code execution is not guaranteed by an out-of-bounds read alone, it serves as a critical stepping stone in attack chains that align with MITRE ATT&CK techniques related to Discovery and Collection, specifically T1082: System Information Discovery or T1537: Transfer Data to Cloud Account if the leaked data facilitates lateral movement.
Mitigation strategies must prioritize immediate patching of the Systerel S2OPC library to version 1.7.4 or later where this issue has been resolved via commit aafbd37d381b618312ebdf5ddf57027f62c14fdd. This patch introduces proper validation checks for the UserAccessLevel parameter before it is processed by the node management helper functions, ensuring that only valid access levels are accepted and preventing the memory violation. In addition to applying the software update, organizations should enforce strict network segmentation policies to limit exposure of OPC UA endpoints to untrusted networks. Implementing robust authentication mechanisms such as X.509 certificate-based mutual TLS is essential to prevent unauthorized entities from sending crafted AddNodes requests. Furthermore, deploying intrusion detection systems capable of inspecting OPC UA protocol payloads can help identify and block attempts to exploit this vulnerability by monitoring for anomalous attribute values or malformed node creation requests that deviate from standard operational patterns.