Executive brief
S2OPC is an OPC UA (industrial automation protocol) server toolkit. A remote attacker can send a specially crafted OPC UA request to crash the server or potentially execute arbitrary code by exploiting a memory corruption flaw in the event filter validation logic. This can disrupt manufacturing operations or process control systems that rely on OPC UA connectivity.
Technical details
A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3's server-side EventFilter validation during CreateMonitoredItems processing. The flaw occurs in the WhereClause result handling: when processing an EventFilter with multiple empty ContentFilterElements, the code allocates a zero-length OperandStatusCodes array for the first element but leaves a non-Good status for the second element due to early return, then unconditionally writes to OperandStatusCodes[0], causing a heap buffer overflow. The vulnerability is reachable remotely via crafted OPC UA network requests without prior authentication. An attacker can crash the server (denial of service) or potentially achieve remote code execution. A patch is available in newer S2OPC versions.
Affected products
- Systerel S2OPC 1.7.3
Timeline
- 2026-08-17: disclosed
- other: Reported in GitHub issue as server-side heap-buffer-overflow in EventFilter WhereClause handling