CVE-2026-67867: Systerel S2OPC Buffer Overflow Vulnerability

CVE-2026-67867 Overview

CVE-2026-67867 is a buffer overflow vulnerability in Systerel S2OPC version 1.7.3, an open-source OPC UA (Open Platform Communications Unified Architecture) toolkit widely used in industrial control system (ICS) environments. The flaw resides in the Alarm/Conditions wrapper when it processes PublishResponseEventNotificationList data returned from an OPC UA server. A remote attacker can send crafted event notification data to trigger the overflow and cause a denial of service (DoS) against the client application. Because S2OPC is embedded in industrial and operational technology (OT) integrations, the impact extends to any monitoring or supervisory client relying on the affected release.

Critical Impact
Remote attackers can crash S2OPC-based OPC UA clients, disrupting alarm and event monitoring in industrial environments that depend on continuous availability.

Affected Products

Systerel S2OPC Toolkit 1.7.3
Applications embedding the S2OPC client wrapper libs2opc_client_alarm_conditions
OPC UA client integrations built on the S2OPC ClientServer frontend

Discovery Timeline

2026-08-05 - CVE-2026-67867 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67867

Vulnerability Analysis

The vulnerability is a buffer overflow in the Alarm/Conditions client wrapper of S2OPC 1.7.3. OPC UA clients use the PublishResponse service response to receive asynchronous notifications from a server subscription. Each response can carry an EventNotificationList containing one or more event field arrays. When the S2OPC client wrapper processes these fields, it fails to safely bound the data written into its internal buffers, resulting in memory corruption and a client-side crash.

The affected logic spans three core components: sopc_event_manager.c in the address space subsystem, libs2opc_client_alarm_conditions.c in the client wrapper, and state_machine.c in the client frontend internals. See the S2OPC event manager source and alarm conditions wrapper source for the vulnerable code paths.

Root Cause

The root cause is missing or insufficient length validation on attacker-controllable fields inside the EventNotificationList before the wrapper copies them into fixed-size internal storage. Untrusted lengths originating from the network-facing PublishResponse propagate through the client state machine into buffer write operations. This falls under the classic buffer overflow class [CWE-121/CWE-120].

Attack Vector

A remote attacker who controls or impersonates an OPC UA server, or who can intercept and modify OPC UA traffic to an S2OPC client, sends a malformed PublishResponse containing oversized or malformed event fields. When the target client subscribes to Alarm/Conditions events and processes the response, the overflow triggers a crash and denial of service. No authentication on the client side is required beyond the normal server-to-client subscription flow. Additional context is available in the public GitHub issue discussion and the vendor's GitLab work item.

No public proof-of-concept exploit and no verified code samples are available. The vulnerability is described in prose per the referenced advisories.

Detection Methods for CVE-2026-67867

Indicators of Compromise

Unexpected termination or repeated crashes of processes linking libs2opc_client_alarm_conditions or other S2OPC client wrapper components.
Loss of Alarm/Conditions telemetry from OPC UA clients immediately following receipt of PublishResponse messages.
Segmentation faults or stack corruption entries in OS crash logs (for example, dmesg, systemd-coredump, or Windows Application event log) referencing S2OPC binaries.

Detection Strategies

Inspect OPC UA network traffic for PublishResponse messages with abnormally large EventFieldList arrays or malformed variant fields.
Enable core-dump collection on hosts running S2OPC clients and alert on crashes of the client process.
Correlate ICS/OT protocol monitoring alerts with sudden gaps in subscription keep-alive traffic to identify DoS conditions.

Monitoring Recommendations

Log and monitor S2OPC client process availability with a supervisor such as systemd, and alert on abnormal restart loops.
Deploy passive OPC UA protocol inspection at the perimeter between OT clients and untrusted or third-party servers.
Track outbound OPC UA sessions from S2OPC clients so that unexpected server endpoints can be flagged for review.

How to Mitigate CVE-2026-67867

Immediate Actions Required

Inventory all deployments of the Systerel S2OPC toolkit and identify systems running version 1.7.3 or embedding the Alarm/Conditions client wrapper.
Restrict S2OPC clients to connect only to trusted, authenticated OPC UA servers using certificate-based SecurityPolicy such as Basic256Sha256 or Aes256_Sha256_RsaPss.
Segment OT networks so that OPC UA clients cannot reach arbitrary or internet-exposed servers.
Monitor the vendor's GitLab work item 1781 for a released fix and plan an upgrade window.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Consult the Systerel S2OPC repository and the linked GitLab work item for updates on patched versions beyond 1.7.3.

Workarounds

Disable the Alarm/Conditions client wrapper in applications that do not require event subscriptions until a patched release is deployed.
Enforce mutual authentication and message signing on all OPC UA sessions so that only trusted servers can deliver PublishResponse messages.
Apply network access control lists (ACLs) that limit outbound OPC UA connections from client hosts to a fixed allowlist of server endpoints.

bash

# Example: restrict outbound OPC UA (TCP/4840) to a specific server allowlist
iptables -A OUTPUT -p tcp --dport 4840 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4840 -j DROP