Executive brief
Systerel S2OPC is an OPC UA toolkit used for building industrial automation and industrial IoT applications. A vulnerability in the handling of range writes to string arrays allows remote attackers to read beyond allocated memory on the server, causing it to crash and denying service to legitimate clients.
Technical details
A heap-based out-of-bounds read vulnerability exists in the `set_range_matrix_on_string_array()` function in src/Common/opcua_types/sopc_builtintypes.c. When processing two-dimensional OPC UA IndexRange writes to String[] values, the function derives the number of source elements to process from the first dimension of the destination range, but fails to verify that the source array contains the same number of elements. An attacker can send a malformed OPC UA Write service request specifying a range larger than the provided source array; the server then dereferences out-of-bounds String objects, reading uninitialized or adjacent heap memory. The vulnerability is remotely exploitable without authentication and causes immediate server crash (denial of service). No patch has been released as of the advisory date.
Affected products
- Systerel S2OPC up to 1.7.3
Timeline
- 2026-08-31: disclosed