Skip to main content

Systerel S2OPC EUVDEUVD-2026-52808

| CVE-2026-18790 LOW
Out-of-bounds Read (CWE-125)
2026-08-04 VulDB GHSA-xq9j-r58r-r55p
Buffer Overflow Information Disclosure S2Opc
1.9
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
1.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local-only vector (AV:L), low-privilege user required (PR:L), no integrity or confidentiality impact - only a low availability disruption (A:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 04, 2026 - 18:22 NVD
MEDIUM LOW
CVSS changed
Aug 04, 2026 - 18:22 NVD
4.8 (MEDIUM) 1.9 (LOW)
Analysis Generated
Aug 04, 2026 - 18:09 vuln.today
CVE Published
Aug 04, 2026 - 17:30 cve.org
MEDIUM 4.8

DescriptionCVE.org

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the OPC-UA client process by triggering a memory read violation in the DeleteMonitoredItemsRequest handler state machine function. The flaw is confined to the client-side wrapper component and results in an availability impact rather than code execution or data exfiltration. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain local low-privilege access
Delivery
Connect as rogue OPC-UA server or inject locally
Exploit
Send crafted DeleteMonitoredItemsResponse
Execution
Trigger out-of-bounds read in state machine
Persist
Crash OPC-UA client process
Impact
Disrupt monitoring availability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local system access with at minimum a low-privileged user account (PR:L per CVSS 4.0 vector) on a host running S2OPC version 1.7.0 through 1.7.3 in client mode. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 4.8 (Medium) accurately reflects the limited real-world blast radius: the attack vector is Local (AV:L), requires low privileges (PR:L), has no user interaction requirement (UI:N), and impacts only availability at a low level (VA:L) with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with a standard user account on a host running the S2OPC client library crafts a malformed DeleteMonitoredItemsResponse message and delivers it to the S2OPC client process - for example, by acting as a rogue OPC-UA server or by injecting data into a local IPC channel. The state machine function `LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse` performs an out-of-bounds read, causing the client process to crash or behave abnormally, disrupting OPC-UA session monitoring in an industrial control context. …
Remediation No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in S2Opc

View all
CVE-2026-9758 HIGH
7.3 Jun 10

Improper certificate trust validation in Systerel S2OPC allows remote attackers to have well-formed but untrusted X.509

CVE-2026-78049 LOW POC
2.9 Aug 22

Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted U
CVE-2026-18257 MEDIUM
5.6 Jul 29

Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certifica
CVE-2026-6899 MEDIUM
5.6 Jun 09

Improper certificate revocation checking in S2OPC's CycloneCrypto wrapper permits OPC UA connections authenticated with

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

EUVD-2026-52808 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy