Executive brief
Systerel S2OPC is an open-source implementation of OPC UA, a protocol widely used in industrial automation and IoT systems. A use-after-free vulnerability in the monitored item event filter handler allows a remote attacker to manipulate event filter arguments and trigger memory corruption, potentially leading to service crashes or code execution. The vulnerability affects all versions up to 1.7.3 and has publicly available exploit code.
Technical details
A use-after-free vulnerability exists in the monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result function in src/ClientServer/services/bgenc/subscription_mgr.c. The vulnerability arises from improper handling of the EventFilter argument in subscription modification requests, where a crafted request that modifies the same monitored item twice (with an empty EventFilter and a partly invalid EventFilter) causes a double free. An unauthenticated remote attacker can trigger this by sending a specially crafted OPC UA message over the network. The fix resets per-item output state (l_revSamplingItv, l_revQueueSize, l_filterResult) before each modification iteration to prevent heap object aliasing. Patch commit a4cee16a851b971be447a6ed531173702c722b99 is available.
Affected products
- Systerel S2OPC up to 1.7.3
Timeline
- 2026-08-31: disclosed
- 2026-08-04: patched: Patch commit a4cee16a851b971be447a6ed531173702c722b99