CVE-2026-18790

Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds

View on CVE.org
Published Aug 4, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

An out‑of‑bounds read vulnerability exists in the DeleteMonitoredItemsRequest handler of Systerel S2OPC, allowing a local attacker to read memory beyond a buffer when the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse function processes a crafted message. This flaw can leak confidential data present in adjacent memory locations and is classified as a classic out‑of‑bounds read weakness (CWE‑119, CWE‑125). The vulnerability does not provide a remote path and requires local execution, but any local user with sufficient privileges can exploit it to obtain sensitive information.

Affected Systems

The issue affects all Systerel S2OPC installations up to and including version 1.7.3. The vulnerability is present in the state_machine.c component within the client wrapper, and there are currently no publicly available patches from the vendor.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score is currently not available, making it difficult to gauge enumeration probability. Because the attack is local, the potential impact is confined to host‑level data exposure, yet the lack of vendor response and the public availability of the exploit increase the risk to any system that allows local access to the affected binary. The vulnerability is not listed in the CISA KEV catalog, but its local exploitation potential still warrants attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Systerel S2OPC to a release newer than 1.7.3 once available.
  • Restrict local access to the S2OPC process by enforcing least‑privilege user rights and limiting user accounts that can run the application.
  • Implement process hardening such as address space layout randomization (ASLR) and stack canaries to reduce the efficacy of out‑of‑bounds reads.

Generated by OpenCVE AI on August 4, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds
First Time appeared Systerel
Systerel s2opc
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:systerel:s2opc:*:*:*:*:*:*:*:*
Vendors & Products Systerel
Systerel s2opc
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 4, 2026, 7:51 PM
Reserved
Aug 4, 2026, 8:41 AM

View source JSON

Updated
Aug 4, 2026, 7:15 PM

JSON

Status
Deferred
Published
Aug 4, 2026, 6:16 PM
Modified
Oct 24, 2026, 4:10 PM

View source JSON

No data.

Updated
Aug 4, 2026, 8:30 PM

JSON