CVE-2026-90782 PUBLISHED

S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

Assigner: VulnCheck
Reserved: 13.09.2026 Published: 13.09.2026 Updated: 13.09.2026

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	Systerel
Product	S2OPC
Versions	Default: unaffected affected from 0 to 1.7.3 (incl.) Version 8848f051eed069b107ae7cb16a346d6f6386a8f5 is unaffected

CVE-2026-90782 PUBLISHED

S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

Metrics

Product Status

Credits

References

Problem Types