Is CVE-2026-82619 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82619 being exploited in the wild.

How severe is CVE-2026-82619?

Medium severity, with a CVSS score of 4.3, published 31 August 2026.

Is there a fix for CVE-2026-82619?

A patch was published on 2026-08-04: Patch commit a4cee16a851b971be447a6ed531173702c722b99 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82619 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82619?

Check whether you run Systerel S2OPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82619: Systerel S2OPC use-after-free in monitored item event filter

CVE-2026-82619 · Severity: medium · CVSS 4.3 · Published 2026-08-31

Systerel S2OPC is an open-source implementation of OPC UA, a protocol widely used in industrial automation and IoT systems. A use-after-free vulnerability in the monitored item event filter handler allows a remote attacker to manipulate event filter arguments and trigger memory corruption, potentially leading to service crashes or code execution. The vulnerability affects all versions up to 1.7.3 and has publicly available exploit code.

Technologies: Systerel S2OPC. Vendors: Systerel.

Quick answers

Is CVE-2026-82619 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82619 being exploited in the wild.
How severe is CVE-2026-82619?: Medium severity, with a CVSS score of 4.3, published 31 August 2026.
Which products and versions are affected?: Systerel S2OPC up to 1.7.3.
Is there a fix for CVE-2026-82619?: A patch was published on 2026-08-04: Patch commit a4cee16a851b971be447a6ed531173702c722b99 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82619 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82619?: Check whether you run Systerel S2OPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result function in src/ClientServer/services/bgenc/subscription_mgr.c. The vulnerability arises from improper handling of the EventFilter argument in subscription modification requests, where a crafted request that modifies the same monitored item twice (with an empty EventFilter and a partly invalid EventFilter) causes a double free. An unauthenticated remote attacker can trigger this by sending a specially crafted OPC UA message over the network. The fix resets per-item output state (l_revSamplingItv, l_revQueueSize, l_filterResult) before each modification iteration to prevent heap object aliasing. Patch commit a4cee16a851b971be447a6ed531173702c722b99 is available.

Affected products

Systerel S2OPC up to 1.7.3

Timeline

2026-08-31: disclosed
2026-08-04: patched: Patch commit a4cee16a851b971be447a6ed531173702c722b99

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.