What is the CVSS score of CVE-2026-67867?

CVE-2026-67867 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Systerel S2OPC are affected by CVE-2026-67867?

S2OPC Toolkit 1.7.3 is vulnerable to remote denial-of-service attacks via malicious OPC UA server communications, with no patch currently available.

How to fix or mitigate CVE-2026-67867?

Within 24 hours, identify all systems running S2OPC Toolkit 1.7.3 and assess exposure scope-determine whether systems connect to external or untrusted servers versus only internal trusted infrastructure. Within 7 days, implement network segmentation and firewall rules restricting OPC UA connections to known trusted servers, establish monitoring and alerting for unexpected S2OPC client process crashes, and disable external OPC UA connections if not essential to operations. Within 30 days, contact Systerel to confirm patch availability timelines, evaluate alternative OPC UA libraries without this vulnerability, and develop a remediation plan for either upgrading to a patched version when available or replacing affected components.

Systerel S2OPC CVE-2026-67867

EUVD-2026-53670 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-05 mitre

GHSA-5rwg-mfvp-wq7w

Buffer Overflow Denial Of Service Heap Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable via OPC UA protocol; no authentication at protocol level in default configurations; DoS only with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:23 vuln.today

CVSS changed

Aug 06, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data

AnalysisAI

Heap-based buffer overflow in Systerel S2OPC Toolkit 1.7.3 enables remote denial of service by sending a crafted OPC UA PublishResponse containing malformed EventNotificationList data to the Alarm/Conditions client wrapper. The affected code paths - libs2opc_client_alarm_conditions.c, state_machine.c, and sopc_event_manager.c - process incoming subscription notification data without adequate bounds checking, allowing a malicious or compromised OPC UA server to crash any connected S2OPC client. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.5/High rating and unauthenticated network vector make this a meaningful risk in OPC UA-enabled industrial environments.

Technical ContextAI

S2OPC is an open-source OPC Unified Architecture (OPC UA) toolkit developed by Systerel, commonly deployed in industrial control system (ICS) and operational technology (OT) environments as a client/server library. CWE-122 (Heap-based Buffer Overflow) indicates the flaw resides in dynamically allocated heap memory - specifically in the Alarm and Conditions subscription wrapper. When an OPC UA client using S2OPC subscribes to Alarm/Condition events and receives a PublishResponse from a server, the EventNotificationList payload is processed by libs2opc_client_alarm_conditions.c and routed through the internal state_machine.c and sopc_event_manager.c. Insufficient validation of the incoming notification data allows oversized or malformed event fields to overflow heap buffers, corrupting memory and crashing the client process. The affected CPE strings from NVD/EUVD are recorded as 'n/a' (no formal CPE assigned), so the exact product enumeration must be derived from the Systerel GitHub repository tag S2OPC_Toolkit_1.7.3.

RemediationAI

Upstream fix is tracked by Systerel in GitLab work item #1781 (https://gitlab.com/systerel/S2OPC/-/work_items/1781); a patched release version is not independently confirmed from available data. Organizations should monitor the Systerel S2OPC repository at https://github.com/systerel/S2OPC for a release newer than 1.7.3 that addresses this issue. As a compensating control, restrict S2OPC client connectivity to trusted, authenticated OPC UA servers using OPC UA Security Mode Sign or SignAndEncrypt with verified server certificates, which would prevent a rogue server from injecting malicious PublishResponse data - note this may require certificate infrastructure changes in environments currently using NoSecurity mode. Additionally, deploy network-level controls (firewall rules, OPC UA-aware proxies) to block connections from untrusted or unexpected OPC UA server endpoints. If the Alarm/Conditions subscription feature is not operationally required, disabling that wrapper integration removes the vulnerable code path entirely; verify with Systerel whether a build-time flag or API-level opt-out exists for this subsystem.