Description
S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Systerel | S2OPC | ≤ 1.7.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
HarshRajSinghania/CVE-2026-90782-s2opc-status-clobber ★ 0 · Sep 14, 2026
Standalone PoC for CVE-2026-90782: status-clobbering NULL dereference in S2OPC alloc_notification_message_items() (DataChange fails, Event succeeds)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitLab issue 1815 issue-tracking
- Patch Commit patch
- Status clobbering and NULL dereference at S2OPC_Toolkit_1.7.3 technical-description
- https://gitlab.com/systerel/S2OPC product
- Merge request !1862 patch
- VulnCheck Advisory: S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items() third-party-advisory