What is the CVSS score of CVE-2026-67865?

CVE-2026-67865 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of S2OPC Toolkit are affected by CVE-2026-67865?

S2OPC Toolkit 1.7.3 contains a high-severity denial-of-service vulnerability allowing unauthenticated remote attackers to crash OPC UA services via crafted network messages, potentially disrupting…

How to fix or mitigate CVE-2026-67865?

Within 24 hours, conduct a complete inventory of all S2OPC Toolkit 1.7.3 deployments across operational technology environments and identify which endpoints are network-accessible or exposed to untrusted networks. Within 7 days, implement network segmentation and firewall rules to restrict OPC UA endpoint access to only authorized systems and trusted networks, enable detailed logging and alerting for abnormal OPC UA message patterns, and document all mitigations for compliance and audit purposes. Within 30 days, establish vendor communication with S2OPC to track patch availability, evaluate intrusion detection rules targeting malformed RepublishResponse messages, and develop a phased upgrade plan to move affected systems to patched versions when the vendor releases them.

S2OPC Toolkit CVE-2026-67865

EUVD-2026-53672 HIGH

Out-of-bounds Read (CWE-125)

2026-08-05 mitre

GHSA-pq6j-99w5-mgfp

Buffer Overflow Denial Of Service Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable OPC UA endpoint requires no authentication; impact is availability-only per the description, consistent with a crash-inducing out-of-bounds read with no confirmed data exfiltration.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:23 vuln.today

CVSS changed

Aug 06, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service

AnalysisAI

Out-of-bounds read in S2OPC Toolkit 1.7.3's RepublishResponse message handler enables unauthenticated remote attackers to crash the OPC UA service via a crafted network message, resulting in denial of service. The vulnerable code paths span the subscription publish service layer (msg_subscription_publish_bs.c, msg_subscription_publish_ack_bs.c) and the common encoder module (sopc_encoder.c). No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates low-barrier remote exploitation requiring no authentication against reachable OPC UA endpoints.

Technical ContextAI

S2OPC (Safe and Secure OPC UA) is an open-source implementation of the OPC Unified Architecture (OPC UA) protocol stack developed by Systerel, targeting industrial automation, ICS, and SCADA environments. OPC UA is a machine-to-machine communication protocol widely used for industrial data exchange. The root cause is CWE-125 (Out-of-bounds Read): during processing of RepublishResponse messages - part of the OPC UA Subscription service that retransmits missed notifications to clients - the toolkit reads beyond the boundary of an allocated buffer. The vulnerability manifests across three source files: the subscription publish handler (msg_subscription_publish_bs.c), the publish acknowledgment handler (msg_subscription_publish_ack_bs.c), and the shared encoder/decoder (sopc_encoder.c). The NVD CPE entry (cpe:2.3:a:n/a:n/a:*) is improperly populated and provides no scoping value; the affected product and version are identified solely through the GitHub source references pinned to the S2OPC_Toolkit_1.7.3 Git tag.

RemediationAI

The primary remediation is to upgrade S2OPC to a version that resolves the out-of-bounds read in RepublishResponse handling; however, no specific patched version number is confirmed in the available data - operators must consult the Systerel GitLab issue (gitlab.com/systerel/S2OPC/-/work_items/1785) and the upstream GitHub repository (github.com/systerel/S2OPC) for a confirmed fix release. Upstream fix available (via GitLab work item and source references); released patched version not independently confirmed. As a compensating control until a patch is applied, restrict network access to OPC UA endpoints using firewall rules or OPC UA security policies (message signing and encryption with certificate-based authentication), which reduces the unauthenticated attack surface at the cost of requiring certificate management overhead. If the OPC UA Subscription and Republish service is not operationally required, disabling it is a targeted mitigation that eliminates the vulnerable code path but will break subscription-based monitoring functionality. Network segmentation isolating OPC UA servers from untrusted segments is an additional defense-in-depth measure with low operational impact.