Executive brief
S2OPC is an open-source OPC UA toolkit used for industrial control and IoT device communication. A memory management flaw in the notification handling code allows attackers to crash the server by triggering specific allocation failures when sessions process both data-change and event notifications, disrupting service availability.
Technical details
The vulnerability is a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed memory allocation for DataChangeNotification is incorrectly overwritten by a subsequent successful allocation for EventNotificationList. This occurs in sessions configured with both data-change and event subscription notifications. An attacker with network access to an OPC UA server can trigger controlled heap allocation failures, causing the server process to terminate (denial of service). The flaw affects S2OPC versions through 1.7.3 and requires no authentication beyond OPC UA session access.
Affected products
- Systerel S2OPC through 1.7.3
Timeline
- 2026-09-13: disclosed