CVE-2026-82618: Systerel S2OPC Out-of-Bounds RCE Flaw

CVE-2026-82618 Overview

CVE-2026-82618 is an out-of-bounds read vulnerability [CWE-119] in Systerel S2OPC versions up to 1.7.3. The flaw resides in the set_range_matrix_on_string_array function within src/Common/opcua_types/sopc_builtintypes.c, part of the String Array Range Writing component. Attackers can trigger the condition remotely over the network by manipulating OPC UA requests targeting string array range writes. S2OPC is an open-source OPC UA toolkit used in industrial control and operational technology (OT) environments, which increases the operational relevance of this issue. According to the vulnerability disclosure, the project was informed through an early issue report but has not yet responded.

Critical Impact
Remote attackers with low privileges can trigger an out-of-bounds read in S2OPC, leading to memory disclosure or process instability in OPC UA server components.

Affected Products

Systerel S2OPC versions up to and including 1.7.3
Component: String Array Range Writing (sopc_builtintypes.c)
Function: set_range_matrix_on_string_array

Discovery Timeline

2026-08-31 - CVE-2026-82618 published to the National Vulnerability Database
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82618

Vulnerability Analysis

The vulnerability affects set_range_matrix_on_string_array, a function responsible for applying range-based writes to string array values inside the S2OPC OPC UA built-in type handling code. When processing crafted range parameters against a string array, the function reads memory outside the bounds of the target buffer. The resulting out-of-bounds read [CWE-119] can leak adjacent memory contents into responses or destabilize the server process. Because OPC UA is a network protocol used for industrial telemetry and control, the exposure surface includes any deployment that permits authenticated clients to issue write requests with index ranges. The disclosure indicates exploitation is possible remotely with low privileges required.

Root Cause

The root cause is improper validation of range indices before dereferencing string array elements in set_range_matrix_on_string_array. The function does not adequately verify that the requested matrix range remains within the allocated bounds of the underlying string array structure before performing read operations. Refer to the GitLab Work Item 1796 for the upstream issue report and technical context.

Attack Vector

An authenticated OPC UA client sends a write request that targets a string array node using a NumericRange or matrix range specification. The malformed or oversized range triggers the vulnerable code path in sopc_builtintypes.c, causing the server to read memory beyond the string array bounds. Impact is limited to availability and potential information exposure through returned data or error paths. See the VulDB CVE-2026-82618 entry for additional technical details.

Detection Methods for CVE-2026-82618

Indicators of Compromise

Unexpected OPC UA server crashes or restarts on hosts running S2OPC 1.7.3 or earlier
OPC UA Write service requests containing unusually large or malformed NumericRange values targeting string array nodes
Anomalous response payload sizes from OPC UA endpoints during write operations
Repeated failed or error-returning write attempts from a single client session

Detection Strategies

Inspect OPC UA traffic (TCP port 4840 by default) for Write requests with out-of-range or malformed range parameters targeting string arrays
Correlate S2OPC process crashes with preceding network activity from specific client sessions
Enable verbose logging within S2OPC to capture range validation failures and abnormal service faults

Monitoring Recommendations

Deploy behavioral monitoring on OT and ICS hosts running S2OPC to detect process termination or memory access anomalies
Baseline normal OPC UA client behavior and alert on deviations in Write service call patterns
Forward OPC UA server logs and host telemetry to a centralized analytics platform for correlation across sessions and endpoints

How to Mitigate CVE-2026-82618

Immediate Actions Required

Inventory all systems running Systerel S2OPC and identify instances at or below version 1.7.3
Restrict network access to OPC UA endpoints using firewall rules that permit only trusted client subnets
Enforce strong authentication and least-privilege user roles on OPC UA servers to limit which clients can issue write operations
Monitor the upstream GitLab issue tracker for vendor response and patch availability

Patch Information

At the time of publication, Systerel had not yet responded to the disclosure and no official patch was available for CVE-2026-82618. Track the GitLab Work Item 1796 and the VulDB advisory for updates. Apply fixes to src/Common/opcua_types/sopc_builtintypes.c as soon as they are published upstream, and rebuild and redeploy any dependent OPC UA server binaries.

Workarounds

Segment OPC UA servers into isolated OT network zones with strict east-west traffic controls
Disable or restrict write access on OPC UA nodes exposing string array variables when not operationally required
Require mutual TLS and certificate-based authentication for all OPC UA client sessions
Rate-limit OPC UA write operations and drop sessions that generate repeated protocol errors

bash

# Example firewall restriction limiting OPC UA access to trusted engineering workstations
iptables -A INPUT -p tcp --dport 4840 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP