CVE-2026-18790 Overview
CVE-2026-18790 is an out-of-bounds read vulnerability in Systerel S2OPC through version 1.7.3. The flaw resides in the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse function within src/ClientServer/frontend/client_wrapper/internal/state_machine.c, which handles DeleteMonitoredItemsRequest responses. An attacker with local access and low privileges can trigger the out-of-bounds read to disclose adjacent memory or cause limited availability impact. A public exploit is available. The vendor was contacted before disclosure but did not respond. The weakness is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Local attackers can trigger an out-of-bounds read in the S2OPC client state machine, potentially exposing process memory or destabilizing OPC UA client operations.
Affected Products
- Systerel S2OPC versions up to and including 1.7.3
- OPC UA client applications using the S2OPC client wrapper
- Deployments incorporating the DeleteMonitoredItemsRequest handler code path
Discovery Timeline
- 2026-08-04 - CVE-2026-18790 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-18790
Vulnerability Analysis
The vulnerability lives inside the S2OPC client-side state machine, which implements the OPC UA client protocol. Specifically, LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse processes server responses to DeleteMonitoredItems service calls. The routine reads response fields without properly validating length or index parameters against the underlying buffer, resulting in a read past the allocated boundary. Because S2OPC is used to embed OPC UA into industrial and operational technology applications, the flaw affects any client instance that processes crafted or malformed responses.
Root Cause
The root cause is missing or insufficient bounds checking when the state machine iterates or indexes into the response payload for deleted monitored items. The code assumes the response structure conforms to expected sizes, and when an attacker can influence the local process's memory or the response data path, the handler dereferences memory outside the intended buffer. This maps directly to [CWE-119], improper restriction of operations within the bounds of a memory buffer.
Attack Vector
Exploitation requires local access with low privileges. An attacker positioned on the same host as the S2OPC client can influence data delivered to the state machine handler or manipulate the local execution context to trigger the out-of-bounds read. A proof-of-concept archive has been published publicly, lowering the barrier to reproduction. The impact is bounded: the CVSS 4.0 vector indicates no confidentiality or integrity impact and only low availability impact, but the exposure remains relevant in OT and industrial environments where client-side stability is essential.
Because verified exploit code from an authoritative source is not reproduced here, refer to the GitHub PoC Archive and the tracking GitHub Issue #13 for technical reproduction details.
Detection Methods for CVE-2026-18790
Indicators of Compromise
- Unexpected crashes, aborts, or restarts of processes linking the S2OPC client wrapper
- AddressSanitizer or Valgrind reports flagging out-of-bounds reads inside state_machine.c
- Presence of the public PoC artifact (poc.zip from the referenced GitHub attachment) on endpoints
- Malformed or unexpected DeleteMonitoredItemsResponse traffic observed in OPC UA session logs
Detection Strategies
- Inventory endpoints and OT assets that ship S2OPC binaries or link against libs2opc_clientwrapper at version 1.7.3 or earlier
- Instrument development and staging builds with AddressSanitizer to catch triggers of the out-of-bounds read in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse
- Correlate S2OPC client process crash events with OPC UA subscription activity involving DeleteMonitoredItems calls
Monitoring Recommendations
- Alert on repeated crashes or abnormal termination of OPC UA client processes on engineering workstations and HMIs
- Monitor filesystem and download telemetry for the published PoC archive filename poc.zip from user-attachment URLs
- Track local privilege usage on hosts running S2OPC clients, since exploitation requires a local, low-privileged foothold
How to Mitigate CVE-2026-18790
Immediate Actions Required
- Identify all deployments of Systerel S2OPC at version 1.7.3 or earlier and prioritize industrial and OT hosts
- Restrict local access to systems running S2OPC clients to trusted operators and service accounts only
- Remove or block execution of the publicly available proof-of-concept archive on managed endpoints
- Monitor the Systerel S2OPC project for a maintainer response and patched release
Patch Information
No vendor patch has been published at the time of disclosure. According to the CVE record, the vendor was contacted early but did not respond. Consult the VulDB CVE-2026-18790 entry and GitHub Issue #13 for updates on fix availability. When a patched version is released, upgrade all client wrapper deployments and rebuild any statically linked applications.
Workarounds
- Where feasible, disable or avoid client code paths that issue DeleteMonitoredItems requests until a fix is available
- Enforce least privilege on hosts running S2OPC clients to limit which local users can reach the vulnerable process
- Apply compiler hardening flags (stack protection, _FORTIFY_SOURCE, position-independent executables) when rebuilding S2OPC from source
- Isolate OPC UA client hosts on segmented networks to reduce the value of any local foothold an attacker might obtain
# Configuration example: locate vulnerable S2OPC binaries and libraries on Linux hosts
find / -type f \( -name 'libs2opc*' -o -name 's2opc_*' \) 2>/dev/null \
| xargs -I{} sh -c 'echo "---"; echo {}; strings {} | grep -E "S2OPC|1\.7\.[0-3]"'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
