EUVD-2026-77009
GHSA-wj27-rfm4-9hp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Session authentication required (PR:L), both subscription types must be active, and heap allocation failure must be induced (AC:H); impact is availability-only with no C or I consequences.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.
AnalysisAI
Null pointer dereference in Systerel S2OPC through version 1.7.3 enables authenticated remote clients to crash the OPC-UA server by inducing heap allocation failures during subscription publish cycles. The defect in msg_subscription_publish_bs__alloc_notification_message_items() silently overwrites a NULL returned by a failed DataChangeNotification allocation with the result of a subsequent EventNotificationList allocation, masking the first failure and causing a deferred NULL dereference that terminates the server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid authenticated OPC-UA session on the target S2OPC server, reflected by PR:L in the CVSS vector; (2) the session must have active subscriptions for BOTH data-change notifications AND event notifications simultaneously - sessions using only one notification type do not traverse the vulnerable dual-allocation code path; (3) the attacker must be able to induce a heap allocation failure during a publish cycle, which in practice requires triggering sufficient memory pressure on the server host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects real-world risk: the flaw is network-reachable but demands both a valid session (PR:L) and the ability to induce heap allocation failure (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix available at GitLab commit 8848f051eed069b107ae7cb16a346d6f6386a8f5 (https://gitlab.com/systerel/S2OPC/-/commit/8848f051eed069b107ae7cb16a346d6f6386a8f5) or merge request 1862 (https://gitlab.com/systerel/S2OPC/-/merge_requests/1862), rebuild from the patched source, and redeploy the server binary. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper certificate trust validation in Systerel S2OPC allows remote attackers to have well-formed but untrusted X.509
Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted U
Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OP
Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certifica
Improper certificate revocation checking in S2OPC's CycloneCrypto wrapper permits OPC UA connections authenticated with
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today