# CVE-2026-78049: Systerel S2OPC out-of-bounds read in AddNodes Service

Source: https://junglewise.ai/threats/cve-2026-78049-systerel-s2opc-out-of-bounds-read-in-addnodes-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78049 · Severity: low · CVSS 3.7 · Published 2026-08-22

Systerel S2OPC is an open-source implementation of the OPC UA protocol, commonly used in industrial control systems and IIoT applications for secure device communication. A vulnerability in the AddNodes Service allows an attacker to trigger an out-of-bounds memory read by manipulating node attributes during node creation, potentially leading to information disclosure or service disruption with network access from a remote location.

Technologies: [Systerel S2OPC](https://junglewise.ai/threats/technologies/s2opc). Vendors: [Systerel](https://junglewise.ai/threats/vendors/systerel).

## Quick answers

**Is CVE-2026-78049 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78049 being exploited in the wild.

**How severe is CVE-2026-78049?** Low severity, with a CVSS score of 3.7, published 22 August 2026.

**Which products and versions are affected?** Systerel S2OPC up to 1.7.3.

**Is there a fix for CVE-2026-78049?** A patch was published on 2026-07-08: Patch commit aafbd37d381b618312ebdf5ddf57027f62c14fdd published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78049 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78049?** Check whether you run Systerel S2OPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds read in the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c. It is triggered by improper handling of the UserAccessLevel argument when processing NodeAttributes during AddNodes Service operations. The attack is remotely exploitable but requires a high degree of complexity to execute. The patch (commit aafbd37d) fixes the issue by implementing proper shallow copies of VariableAttributes, ObjectAttributes, and MethodAttributes structures to ensure bounds-safe attribute handling. The vulnerability allows remote attackers to read memory contents beyond intended boundaries.

## Affected products

- Systerel S2OPC up to 1.7.3

## Timeline

- 2026-08-22: disclosed: Vulnerability disclosed publicly
- 2026-07-08: patched: Patch commit aafbd37d381b618312ebdf5ddf57027f62c14fdd published

## References

- [https://github.com/user-attachments/files/29702766/PoC.zip](https://github.com/user-attachments/files/29702766/PoC.zip)
- [https://gitlab.com/systerel/S2OPC/-/commit/aafbd37d381b618312ebdf5ddf57027f62c14fdd](https://gitlab.com/systerel/S2OPC/-/commit/aafbd37d381b618312ebdf5ddf57027f62c14fdd)

## Related threats

- [S2OPC null pointer dereference in notification message allocation](https://junglewise.ai/threats/cve-2026-90782-s2opc-null-pointer-dereference-in-notification-message-allocation)
- [Systerel S2OPC use-after-free in monitored item event filter](https://junglewise.ai/threats/cve-2026-82619-systerel-s2opc-use-after-free-in-monitored-item-event-filter)
- [Systerel S2OPC out-of-bounds read in string array range writing](https://junglewise.ai/threats/cve-2026-82618-systerel-s2opc-out-of-bounds-read-in-string-array-range-writing)
- [Systerel S2OPC heap-based buffer overflow in EventFilter handling](https://junglewise.ai/threats/cve-2026-67868-systerel-s2opc-heap-based-buffer-overflow-in-eventfilter-handling)
- [Systerel S2OPC out-of-bounds read in DeleteMonitoredItemsResponse handler](https://junglewise.ai/threats/cve-2026-18790-systerel-s2opc-out-of-bounds-read-in-deletemonitoreditemsresponse)