Junglewise Threat Intelligence

CVE-2026-78049: Systerel S2OPC out-of-bounds read in AddNodes Service

CVE-2026-78049 · Severity: low · CVSS 3.7 · Published 2026-08-22

Technologies: Systerel S2OPC. Vendors: Systerel.

Executive brief

Systerel S2OPC is an open-source implementation of the OPC UA protocol, commonly used in industrial control systems and IIoT applications for secure device communication. A vulnerability in the AddNodes Service allows an attacker to trigger an out-of-bounds memory read by manipulating node attributes during node creation, potentially leading to information disclosure or service disruption with network access from a remote location.

Technical details

The vulnerability is an out-of-bounds read in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c. It is triggered by improper handling of the UserAccessLevel argument when processing NodeAttributes during AddNodes Service operations. The attack is remotely exploitable but requires a high degree of complexity to execute. The patch (commit aafbd37d) fixes the issue by implementing proper shallow copies of VariableAttributes, ObjectAttributes, and MethodAttributes structures to ensure bounds-safe attribute handling. The vulnerability allows remote attackers to read memory contents beyond intended boundaries.

Affected products

  • Systerel S2OPC up to 1.7.3

Timeline

  • 2026-08-22: disclosed: Vulnerability disclosed publicly
  • 2026-07-08: patched: Patch commit aafbd37d381b618312ebdf5ddf57027f62c14fdd published

References

Related threats