Systerel S2OPC CVE-2026-82619

Exploitation requires an established OPC UA session with sufficient rights to create subscriptions and register monitored items with EventFilters - corresponding to PR:L in the CVSS 4.0 vector, meaning at minimum a low-privileged authenticated OPC UA client account or an anonymous session if the server permits anonymous subscription creation. The OPC UA EventFilter feature of the subscription service must be reachable by the attacker's session; deployments that disable subscription creation or restrict it to high-privilege roles would not be exploitable via this path. Deployments enforcing strict certificate-based mutual authentication and limiting subscription privileges to named service accounts significantly reduce exposure, while internet-exposed OPC UA servers permitting anonymous or weakly authenticated sessions face the highest realistic risk. Exploitation is bounded to availability impact only - no memory write primitive or code execution path is suggested by available data.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) reflects a moderate, network-exploitable denial-of-service requiring low privileges but no special attack prerequisites beyond an authenticated OPC UA session with subscription rights. The E:P supplemental metric confirms a publicly available proof-of-concept, raising practical exploitability above the raw score implies. The vulnerability is absent from CISA KEV and no EPSS score was provided in the available data - exploitation likelihood from automated scanning cannot be quantified from supplied inputs. While the CVSS VA:L rating suggests limited per-incident impact, defenders in industrial environments should weight operational disruption risk independently: loss of OPC UA server availability may interrupt process telemetry or control loops in ways that are disproportionate to a generic IT availability score. No confidentiality or integrity impact pathway is indicated by available data, which is consistent with a pure use-after-free crash scenario rather than controlled memory write.

An attacker holding a low-privileged OPC UA client session - achievable via default anonymous access on misconfigured deployments or via valid credentials on hardened ones - submits a subscription request containing a malformed EventFilter argument. The S2OPC server processes the filter initialization in subscription_mgr.c, triggers the use-after-free condition, and crashes, denying OPC UA communication to all connected clients. A public proof-of-concept referenced in GitLab work item https://gitlab.com/systerel/S2OPC/-/work_items/1797 lowers the skill requirement for this attack.