Systerel S2OPC EUVD-2026-64599

The target must be running an S2OPC server instance in a mode where the AddNodes Node Management service is accessible to remote clients - this is a standard but not universally enabled OPC UA service. No authentication is required per the CVSS 4.0 vector (PR:N), but the exploit requires high attack complexity (AC:H), implying that precise crafting of the UserAccessLevel argument is needed to trigger the out-of-bounds condition - casual or automated scanning is unlikely to trigger it reliably. Exploitation is limited to availability impact (service disruption) per CVSS indicators; no confidentiality or integrity conditions are triggered. Deployments that restrict AddNodes service access via OPC UA access control policies, or that do not expose the OPC UA endpoint to untrusted networks, are not practically exposed.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P) scores 6.3, reflecting network reachability without authentication but with high attack complexity. The impact is confined to low availability on the vulnerable system - no confidentiality or integrity loss is indicated. EPSS data was not provided in the input. This vulnerability is not listed in CISA KEV, meaning active exploitation in the wild is not confirmed. A public POC exists (E:P), which elevates the practical threat modestly. However, AC:H is a meaningful limiting factor - crafting a valid exploit requires deep knowledge of OPC UA protocol framing and specific message construction. In OT/ICS contexts, even availability impacts carry elevated operational risk, as S2OPC deployments may underpin safety-critical or production-critical systems. The disconnect between tags ('Buffer Overflow') and the actual CWE (CWE-125, Out-of-Bounds Read) should be noted - the root cause is a read, not a write, which limits exploitability for code execution but may still enable information disclosure depending on memory layout.

A remote attacker with knowledge of OPC UA protocol internals sends a crafted AddNodes service request to an S2OPC server running version 1.7.3 or earlier, constructing a malformed UserAccessLevel field designed to trigger the out-of-bounds read in SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes. The resulting memory read can cause the server process to crash (low availability impact) or potentially expose adjacent memory content depending on runtime memory layout. A public POC file (PoC.zip) has been disclosed via GitHub, lowering the bar for exploitation by parties with OPC UA knowledge.