CVE-2026-78049 Overview
CVE-2026-78049 is an out-of-bounds read vulnerability [CWE-119] in Systerel S2OPC versions up to 1.7.3. The flaw resides in the SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes function within src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c, part of the AddNodes Service component. Manipulation of the UserAccessLevel argument triggers reads past allocated memory boundaries. An attacker can initiate the attack remotely, but exploitation requires high complexity. A proof-of-concept has been publicly disclosed, and Systerel has issued patch aafbd37d381b618312ebdf5ddf57027f62c14fdd to remediate the issue.
Critical Impact
Remote attackers can trigger out-of-bounds memory reads in the S2OPC OPC UA server, potentially leaking limited process memory or causing service instability in industrial control environments.
Affected Products
- Systerel S2OPC versions up to and including 1.7.3
- OPC UA client/server implementations built on affected S2OPC releases
- Industrial control systems and SCADA integrations embedding vulnerable S2OPC libraries
Discovery Timeline
- 2026-08-22 - CVE-2026-78049 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78049
Vulnerability Analysis
S2OPC is Systerel's open-source OPC UA (Open Platform Communications Unified Architecture) toolkit widely deployed in industrial automation. The vulnerability affects the AddNodes Service, an OPC UA server-side operation that allows clients to add nodes to the server's address space. The vulnerable function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes processes attributes supplied by the requesting client when creating a new Variable node.
The UserAccessLevel attribute is interpreted during node creation without adequate bounds validation. Crafted input causes the function to read memory outside the intended buffer, leading to an information exposure primitive with a low availability impact. Exploitation is remote but rated as high complexity, reflecting protocol-level constraints and required session state.
Root Cause
The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119]. The handler for the UserAccessLevel argument does not verify the size or structure of the attribute before dereferencing it, allowing the code path to access memory beyond the allocated region.
Attack Vector
An attacker with network reachability to a vulnerable S2OPC server issues an AddNodes service request containing malformed UserAccessLevel data. No authentication is required by the vulnerability itself, though deployment-specific OPC UA session controls may apply. Successful exploitation yields limited memory disclosure or transient server disruption.
Refer to the GitLab commit details and the publicly available proof-of-concept for technical specifics of the malformed request structure.
Detection Methods for CVE-2026-78049
Indicators of Compromise
- Unexpected OPC UA AddNodes service requests originating from unauthenticated or untrusted clients
- S2OPC server crashes, restarts, or anomalous log entries referencing SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes
- Malformed UserAccessLevel attribute values in OPC UA session traces
Detection Strategies
- Deploy OPC UA-aware deep packet inspection to flag AddNodes requests with abnormal attribute encodings
- Correlate S2OPC application logs with network telemetry to identify repeated failed AddNodes attempts
- Baseline legitimate AddNodes activity in production and alert on deviations, since node addition is uncommon at runtime
Monitoring Recommendations
- Monitor process health and memory-access exceptions on hosts running S2OPC servers
- Capture and retain OPC UA session metadata for forensic review of client identities issuing AddNodes calls
- Alert on any AddNodes traffic sourced from OT segments that should be read-only or client-only
How to Mitigate CVE-2026-78049
Immediate Actions Required
- Inventory all systems running Systerel S2OPC and identify versions at or below 1.7.3
- Apply the upstream fix identified by commit aafbd37d381b618312ebdf5ddf57027f62c14fdd from the S2OPC repository
- Restrict network access to OPC UA endpoints to trusted management hosts only
- Enforce OPC UA server configuration that disables or authenticates the AddNodes service
Patch Information
Systerel has merged the fix via merge request 1826, tracked under work item 1787. Rebuild and redeploy S2OPC-based products against a fixed revision containing commit aafbd37d381b618312ebdf5ddf57027f62c14fdd. Additional context is available on the VulDB entry for CVE-2026-78049.
Workarounds
- Disable the AddNodes service on production OPC UA servers where dynamic node creation is not required
- Require strong client authentication and certificate validation on all OPC UA sessions
- Segment OT networks so that S2OPC servers are unreachable from enterprise or internet-facing zones
- Rate-limit and log AddNodes requests at the OPC UA gateway or firewall layer
# Configuration example
# Rebuild S2OPC from a patched revision
git clone https://gitlab.com/systerel/S2OPC.git
cd S2OPC
git checkout aafbd37d381b618312ebdf5ddf57027f62c14fdd
./build.sh
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
