Quick answers
- Is CVE-2026-78049 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78049 being exploited in the wild.
- How severe is CVE-2026-78049?
- Low severity, with a CVSS score of 3.7, published 22 August 2026.
- Which products and versions are affected?
- Systerel S2OPC up to 1.7.3.
- Is there a fix for CVE-2026-78049?
- A patch was published on 2026-07-08: Patch commit aafbd37d381b618312ebdf5ddf57027f62c14fdd published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78049 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78049?
- Check whether you run Systerel S2OPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds read in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c. It is triggered by improper handling of the UserAccessLevel argument when processing NodeAttributes during AddNodes Service operations. The attack is remotely exploitable but requires a high degree of complexity to execute. The patch (commit aafbd37d) fixes the issue by implementing proper shallow copies of VariableAttributes, ObjectAttributes, and MethodAttributes structures to ensure bounds-safe attribute handling. The vulnerability allows remote attackers to read memory contents beyond intended boundaries.
Affected products
- Systerel S2OPC up to 1.7.3
Timeline
- 2026-08-22: disclosed: Vulnerability disclosed publicly
- 2026-07-08: patched: Patch commit aafbd37d381b618312ebdf5ddf57027f62c14fdd published