CVE-2026-67866: Systerel S2OPC Buffer Overflow Vulnerability

CVE-2026-67866 Overview

CVE-2026-67866 is a buffer overflow vulnerability in Systerel S2OPC 1.7.3, an open-source OPC UA (Unified Architecture) toolkit widely used in industrial control and operational technology (OT) environments. The flaw resides in the client wrapper code that handles DeleteMonitoredItems responses, specifically within the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems functions. A remote attacker can trigger the overflow to cause a denial of service against clients built on the affected library. Because S2OPC is embedded in industrial supervisory clients and edge gateways, exploitation can disrupt monitoring pipelines that rely on OPC UA subscriptions.

Critical Impact
Remote attackers can cause denial of service in S2OPC 1.7.3 clients by exploiting the buffer overflow in the DeleteMonitoredItems response processing path.

Affected Products

Systerel S2OPC version 1.7.3
OPC UA client applications built on the S2OPC client wrapper
Industrial and OT integrations that consume the state_machine.c client subscribe workflow

Discovery Timeline

2026-08-05 - CVE-2026-67866 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67866

Vulnerability Analysis

S2OPC provides an OPC UA client and server implementation in C. The client wrapper exposes a state machine, defined in state_machine.c, that manages subscription lifecycle events including creating and deleting monitored items. The vulnerable code paths, LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems, process attacker-influenced fields from server responses without adequately validating array bounds. This is classified as a Buffer Overflow [CWE-120/CWE-121] leading to Denial of Service.

When a malicious or compromised OPC UA server returns a DeleteMonitoredItemsResponse with sizes or counts that exceed what the client-side buffers can hold, the wrapper writes past allocated memory. The immediate observable effect is a crash of the client process, breaking any long-running subscription session. See the GitHub Issue Discussion and the GitLab Work Item #1780 for maintainer analysis.

Root Cause

The root cause is missing or insufficient bounds checking in the client wrapper functions that reconcile server-returned DeleteMonitoredItems results with the client's internal subscription state. The state machine copies response elements into fixed-size structures without validating the count field against buffer capacity.

Attack Vector

An attacker who controls or impersonates an OPC UA server that a vulnerable S2OPC client connects to can send a crafted DeleteMonitoredItemsResponse message. The attack requires the client to invoke the delete-monitored-items code path, which is reachable through the standard subscription workflow demonstrated in the subscribe.c example. Detailed source-level context is available in the S2OPC state machine implementation.

No verified proof-of-concept code has been published. The vulnerability is described in prose based on maintainer references; readers seeking exploit specifics should consult the linked issue trackers.

Detection Methods for CVE-2026-67866

Indicators of Compromise

Unexpected termination or crash of S2OPC-based OPC UA client processes shortly after receiving a DeleteMonitoredItemsResponse.
Core dumps or segmentation faults referencing LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse or SOPC_StaMac_NewDeleteMonitoredItems in the stack trace.
OPC UA sessions from untrusted or newly introduced server endpoints preceding client failures.

Detection Strategies

Inspect OPC UA traffic for DeleteMonitoredItemsResponse messages whose Results array size disagrees with the corresponding request count.
Correlate client-side process crashes with the timestamps of inbound OPC UA response frames on TCP port 4840.
Deploy binary versioning checks across OT assets to flag S2OPC 1.7.3 deployments in the fleet.

Monitoring Recommendations

Enable verbose logging in the S2OPC client wrapper to record subscription state transitions and response handling events.
Aggregate industrial endpoint telemetry into a centralized data lake to correlate crash signals with upstream OPC UA server behavior.
Alert on repeated abnormal disconnects between OPC UA clients and specific server endpoints.

How to Mitigate CVE-2026-67866

Immediate Actions Required

Inventory all deployments of Systerel S2OPC and identify systems running version 1.7.3.
Restrict OPC UA client connections to authenticated, allow-listed server endpoints to reduce exposure to malicious responses.
Segment OT networks so that OPC UA traffic cannot traverse arbitrary IT paths.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Track the maintainer's GitLab Work Item #1780 and the GitHub Issue Discussion for the official fix and upgrade guidance. Upgrade to a patched release once Systerel publishes one.

Workarounds

Disable or avoid use of the DeleteMonitoredItems client workflow where operationally feasible until a patched version is available.
Enforce mutual TLS and OPC UA user authentication so that only trusted servers can send responses to production clients.
Deploy application-layer filtering that validates DeleteMonitoredItemsResponseResults array sizes before they reach vulnerable clients.
Run S2OPC client processes under supervisor control that restarts them cleanly and logs crashes for forensic review.

bash

# Configuration example: restrict outbound OPC UA client connections to trusted servers
iptables -A OUTPUT -p tcp --dport 4840 -d 10.20.30.40 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -j DROP