CVE-2026-78049

Received Received - Intake

Out-of-Bounds Read in Systerel S2OPC

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulDB

Description

A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-22

Generated

2026-08-23

AI Q&A

2026-08-23

EPSS Evaluated

N/A

NVD

CVE-2026-78049

EUVD

EUVD-2026-64599

Affected Vendors & Products

Vendor	Product	Version / Range
systerel	s2opc	to 1.7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Systerel S2OPC versions up to 1.7.3. It affects the AddNodes Service component, specifically the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes in the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c. The issue involves an out-of-bounds read vulnerability triggered by manipulation of the UserAccessLevel argument. The attack can be initiated remotely but requires high complexity and is considered difficult to exploit.

Detection Guidance

This vulnerability affects the Systerel S2OPC component up to version 1.7.3. Detection requires checking the installed version of S2OPC. If the version is 1.7.3 or lower, the system is vulnerable. Use commands like 'sopc_server --version' or check package managers for installed versions.

Impact Analysis

The vulnerability may allow an attacker to read memory outside the intended bounds, potentially leading to information disclosure or system crashes. However, the high complexity required for exploitation and the lack of known public exploits reduce the immediate risk. The impact is limited due to the low CVSS scores across all versions.

Compliance Impact

This vulnerability involves an out-of-bounds read due to manipulation of the UserAccessLevel argument in the Systerel S2OPC AddNodes Service. While it does not directly impact data confidentiality or integrity, it could potentially lead to unauthorized access or information disclosure if exploited. This may pose risks to compliance with GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized data exposure or system access.

Mitigation Strategies

Immediately update Systerel S2OPC to a version beyond 1.7.3. The patch identifier is aafbd37d381b618312ebdf5ddf57027f62c14fdd. If updating is not possible, restrict network access to the vulnerable service or disable the AddNodes Service component until patched.

Hi! I’m here to help you understand CVE-2026-78049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70