CVE-2026-67865 Overview
CVE-2026-67865 is an out-of-bounds read vulnerability in S2OPC 1.7.3, an open-source OPC UA (Open Platform Communications Unified Architecture) toolkit maintained by Systerel. The flaw resides in the handling of RepublishResponse messages within the ClientServer subscription service. A remote attacker can trigger the out-of-bounds read to cause a denial of service against affected S2OPC deployments. Because S2OPC is commonly embedded in industrial control system (ICS) and operational technology (OT) components, disruption can affect the availability of monitoring and control data.
Critical Impact
Remote attackers can cause denial of service on S2OPC 1.7.3 endpoints by exploiting improper bounds checking during RepublishResponse processing.
Affected Products
- S2OPC Toolkit 1.7.3
- S2OPC ClientServer subscription services (msg_subscription_publish_bs.c, msg_subscription_publish_ack_bs.c)
- OPC UA encoder component (sopc_encoder.c)
Discovery Timeline
- 2026-08-05 - CVE-2026-67865 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67865
Vulnerability Analysis
S2OPC implements the OPC UA client/server protocol used across industrial automation deployments. The vulnerability sits in the subscription publish flow, where the toolkit constructs and decodes RepublishResponse messages. During decoding, the affected code path in msg_subscription_publish_bs.c and the encoder logic in sopc_encoder.c reads sequence data without adequately validating the declared length against the actual buffer bounds. An attacker who can send crafted OPC UA traffic to a vulnerable server can cause the process to read past the end of a heap buffer. The read triggers a fault that terminates the server, breaking client sessions and interrupting subscription-driven data flows to supervisory systems.
Root Cause
The root cause is insufficient bounds validation on attacker-influenced length or index fields consumed while assembling or parsing a RepublishResponse. The decoder trusts a size value from the wire and advances the read pointer beyond the allocated buffer. This class of defect is tracked as an out-of-bounds read and typically maps to [CWE-125].
Attack Vector
Exploitation requires network reachability to the S2OPC server endpoint and the ability to establish an OPC UA session capable of triggering the republish code path. No user interaction is required on the target. Once the malformed request is processed, the out-of-bounds read causes a crash, producing a denial of service. Refer to the GitHub S2OPC Subscription Code and GitHub S2OPC Encoder Code for the specific functions involved.
// No verified proof-of-concept code is published for CVE-2026-67865.
// See the vendor tracker at GitLab S2OPC Work Item #1785 for status.
Detection Methods for CVE-2026-67865
Indicators of Compromise
- Unexpected termination or repeated restarts of S2OPC-based OPC UA server processes
- Crash dumps or core files referencing msg_subscription_publish_bs.c or sopc_encoder.c
- OPC UA client sessions dropping simultaneously across multiple endpoints without a corresponding operational event
Detection Strategies
- Monitor OPC UA traffic on TCP 4840 for malformed or oversized RepublishRequest messages targeting active subscriptions
- Correlate process-exit events on OPC UA servers with inbound network flows from non-baseline peers
- Enable verbose logging in the S2OPC toolkit and alert on decoder errors emitted from the subscription publish path
Monitoring Recommendations
- Baseline expected OPC UA clients and alert on new source addresses initiating republish sequences
- Track service availability metrics for OPC UA endpoints and page on repeated restart loops
- Forward S2OPC application logs to a centralized SIEM for correlation with ICS/OT network telemetry
How to Mitigate CVE-2026-67865
Immediate Actions Required
- Inventory all deployments running S2OPC Toolkit 1.7.3 and identify network-exposed OPC UA endpoints
- Restrict access to OPC UA server ports (default TCP 4840) to authenticated clients on trusted OT network segments
- Track the vendor tracker at GitLab S2OPC Work Item #1785 for a fixed release
Patch Information
At the time of publication, the NVD entry for CVE-2026-67865 does not reference a fixed release. Operators should monitor the upstream repository at GitHub S2OPC and the associated GitLab S2OPC Work Item #1785 for patch availability, then upgrade all S2OPC-based servers to the fixed version once released.
Workarounds
- Place S2OPC servers behind an OPC UA-aware firewall or gateway that validates message framing before forwarding
- Enforce OPC UA SignAndEncrypt security policies and mutual certificate authentication to limit the pool of clients that can reach the vulnerable code path
- Segment OT networks so that engineering workstations and third-party integrators cannot reach production OPC UA endpoints without brokered access
- Configure automatic service supervision to restart crashed S2OPC processes while a patch is pending, and alert on restart frequency
# Example: restrict OPC UA access to a specific management subnet using iptables
iptables -A INPUT -p tcp --dport 4840 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
