CVE-2026-90782: S2OPC Null Pointer Dereference DoS Vulnerability

CVE-2026-90782 Overview

CVE-2026-90782 is a null pointer dereference vulnerability [CWE-476] affecting Systerel S2OPC through version 1.7.3. The flaw resides in the msg_subscription_publish_bs__alloc_notification_message_items() function within the OPC UA subscription publish service. A failed heap allocation for a DataChangeNotification structure is overwritten by a subsequent successful allocation for an EventNotificationList, leaving the earlier null pointer dereferenceable later in the code path. Authenticated attackers with a session subscribing to both data-change and event notifications can trigger the condition to crash the server process.

Critical Impact
Authenticated remote attackers can terminate the S2OPC OPC UA server process, disrupting industrial control system availability on affected deployments.

Affected Products

Systerel S2OPC OPC UA Toolkit versions up to and including 1.7.3
S2OPC ClientServer subscription publish service (msg_subscription_publish_bs.c)
Deployments exposing OPC UA servers that permit sessions with both data-change and event notifications

Discovery Timeline

2026-09-13 - CVE-2026-90782 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90782

Vulnerability Analysis

The vulnerability is a null pointer dereference in the S2OPC OPC UA server's notification message assembly routine. The function msg_subscription_publish_bs__alloc_notification_message_items() allocates two structures for a publish response: a DataChangeNotification and an EventNotificationList. When the first allocation for the DataChangeNotification fails, the resulting null pointer is not surfaced as an error. Instead, the shared output pointer is overwritten by the subsequent successful allocation for the EventNotificationList, masking the failure. Later code paths assume the DataChangeNotification pointer is valid and dereference it, causing the server process to crash. The issue is tracked in S2OPC Issue #1815 and fixed by commit 8848f05.

Root Cause

The root cause is improper error handling in the sequential allocation logic within msg_subscription_publish_bs.c at lines 106–147. The function does not abort or propagate the allocation failure when DataChangeNotification allocation returns null. Because the same output slot is reused for the second EventNotificationList allocation, the failure state becomes invisible to callers. Refer to the S2OPC Toolkit source for the affected code region.

Attack Vector

Exploitation requires an authenticated OPC UA session with low privileges. An attacker establishes a subscription that includes both data-change and event notifications, then induces heap allocation pressure to force the DataChangeNotification allocation to fail while the smaller EventNotificationList allocation succeeds. When the server subsequently processes the publish response, it dereferences the null pointer and terminates. No user interaction is required. Detailed exploitation conditions are described in the VulnCheck advisory.

Detection Methods for CVE-2026-90782

Indicators of Compromise

Unexpected termination or segmentation faults of the S2OPC server process shortly after publish requests
Authenticated OPC UA sessions creating subscriptions with both DataChangeNotifications and EventNotificationList items
Repeated session reconnections following server crashes on port 4840 or configured OPC UA endpoints

Detection Strategies

Monitor S2OPC server logs for abnormal exit codes, core dumps, or watchdog-triggered restarts
Inspect OPC UA CreateSubscription and CreateMonitoredItems traffic for sessions mixing data-change and event notification types
Correlate heap allocation failures or memory pressure events on ICS hosts with subsequent OPC UA service outages

Monitoring Recommendations

Enable process supervision and crash reporting on hosts running S2OPC-based OPC UA servers
Ingest OPC UA server telemetry into a central SIEM to alert on repeated service restarts
Track authenticated session activity and rate-limit clients producing anomalous subscription patterns

How to Mitigate CVE-2026-90782

Immediate Actions Required

Upgrade S2OPC to a version containing commit 8848f05 or later
Restrict OPC UA server access to trusted network segments and authenticated ICS clients only
Audit existing user accounts and remove unnecessary session-creation privileges

Patch Information

The fix is delivered via S2OPC Merge Request #1862 and commit 8848f05 in the Systerel S2OPC repository. Operators should rebuild affected S2OPC-based products against a patched toolkit revision and redeploy server binaries. Vendors embedding S2OPC in industrial products should publish downstream advisories referencing the upstream fix.

Workarounds

Configure subscriptions to avoid combining data-change and event notifications on the same session where feasible
Place OPC UA servers behind a segmentation firewall that permits only vetted client addresses
Enforce strict authentication policies and revoke credentials for clients not requiring subscription functionality

bash

# Example: restrict OPC UA endpoint exposure with host firewall rules
iptables -A INPUT -p tcp --dport 4840 -s <trusted_client_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP