Systerel S2OPC EUVD-2026-52808

Exploitation requires local system access with at minimum a low-privileged user account (PR:L per CVSS 4.0 vector) on a host running S2OPC version 1.7.0 through 1.7.3 in client mode. The vulnerability is triggered specifically during the processing of a DeleteMonitoredItemsResponse message within the OPC-UA client state machine - the attacker must be able to deliver a crafted response to the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse function, either by acting as a rogue OPC-UA server the client connects to, or by interacting with the local process via an available interface. Remote unauthenticated exploitation is not possible (AV:L). Limiting factors: physical or authenticated local access to the target system is mandatory; the impact is limited to low-level availability disruption (process crash) with no confirmed code execution or data exfiltration path; only S2OPC deployments in client operational mode are affected.

The CVSS 4.0 base score of 4.8 (Medium) accurately reflects the limited real-world blast radius: the attack vector is Local (AV:L), requires low privileges (PR:L), has no user interaction requirement (UI:N), and impacts only availability at a low level (VA:L) with no confidentiality or integrity impact. There is no network-based exploitation path, which substantially constrains attacker opportunity. The EPSS score is not provided in the input data. KEV status is negative - no confirmed active exploitation has been reported to CISA. However, a public proof-of-concept exploit zip file is hosted on GitHub, elevating the realistic exploitation probability beyond a theoretical flaw. The combination of POC availability, vendor non-response, and no released patch represents a meaningful gap for organizations running this library. Critically, the industrial/ICS deployment context of S2OPC means that even a low-severity availability disruption could have operational consequences in process control environments. SSVC signals: exploitation is possible (POC exists), not automatable due to local-only vector, and technical impact is partial. This is a real but bounded priority - organizations in OT/ICS environments should treat this more seriously than the numeric CVSS score alone suggests.

A local attacker with a standard user account on a host running the S2OPC client library crafts a malformed DeleteMonitoredItemsResponse message and delivers it to the S2OPC client process - for example, by acting as a rogue OPC-UA server or by injecting data into a local IPC channel. The state machine function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse performs an out-of-bounds read, causing the client process to crash or behave abnormally, disrupting OPC-UA session monitoring in an industrial control context. A public proof-of-concept exploit (poc.zip) is available on GitHub, lowering the bar for exploitation.