Buffer Overflow in Systerel S2OPC

Executive Summary

CVE-2026-67871 is a server-side type confusion vulnerability in S2OPC Toolkit version 1.7.3. It allows a remote heap-buffer-overflow read attack when the AddNodes service is used with Node Management enabled. A malicious client sends a crafted AddNodesRequest where the NodeClass is set to Variable but the NodeAttributes ExtensionObject is the generic OpcUa_NodeAttributes type instead of the expected OpcUa_VariableAttributes type. The server incorrectly accepts this, leading to a heap out-of-bounds read and causing a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or unusual behavior in S2OPC servers using version 1.7.3. Check server logs for segmentation faults or heap corruption errors during AddNodes operations. Use tools like Valgrind to detect memory issues in the address_space_bs.c and sopc_node_mgt_helper_internal.c components. Monitor network traffic for malformed OPC UA AddNodesRequest packets with mismatched NodeClass and NodeAttributes types.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by crashing the S2OPC server process. If exploited, it may disrupt OPC UA server operations, leading to system instability or unavailability. Systems relying on S2OPC Toolkit 1.7.3 for OPC UA communication could experience unexpected crashes or degraded performance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade S2OPC to a patched version beyond 1.7.3. If upgrading is not possible, disable the AddNodes service or Node Management feature in the OPC UA server configuration. Implement input validation for AddNodesRequest packets to ensure NodeClass and NodeAttributes types match. Use network firewalls to restrict access to OPC UA services from untrusted clients.

Useful 0 Not Useful 0