Description

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T22:17:25.790Z",
  "pubdate": "2026-08-17T22:17:25.790Z",
  "executiveSummary": "A critical heap-based out-of-bounds write vulnerability has been identified in S2OPC version 1.7.3, specifically residing within the server-side EventFilter handling mechanism during the processing of CreateMonitoredItems requests.\nThis vulnerability allows an unauthenticated remote attacker to corrupt heap memory by supplying maliciously crafted payloads, ultimately leading to arbitrary code execution within the context of the affected server process.\nThe flaw poses severe risk implications for industrial control systems and OPC UA deployments utilizing S2OPC, as successful exploitation compromises the confidentiality, integrity, and availability of the host system.\nAttackers can leverage network connectivity to the OPC UA endpoint to trigger the vulnerability without requiring prior authentication or privileged access, provided the server processes the vulnerable CreateMonitoredItems service request containing an engineered EventFilter structure.",
  "technicalDetails": "The vulnerability is caused by an improper bounds check or memory calculation error during the handling of EventFilter parameters within the CreateMonitoredItems service on the server side of S2OPC 1.7.3.\nWhen a client transmits a CreateMonitoredItems request containing a specially crafted EventFilter, the vulnerable component fails to properly validate the size and boundaries of incoming data structures before copying them into dynamically allocated heap memory buffers.\nThe exploitation flow begins with a remote attacker establishing a network connection to the OPC UA server and initiating a session. The attacker then sends a crafted OPC UA CreateMonitoredItems request where the EventFilter payload includes manipulated length or index parameters.\nDuring the server-side parsing and processing of these parameters, the application performs a heap-based write operation that exceeds the allocated boundaries of the target buffer, resulting in heap memory corruption.\nBy carefully engineering the heap layout and the out-of-bounds write content, an attacker can overwrite adjacent heap metadata or critical function pointers.\nSubsequent execution flow redirection leads to arbitrary code execution with the privileges of the S2OPC server process.\nNetwork exposure is inherent to the OPC UA protocol implementation, as the vulnerable endpoint listens for incoming client connections by default.\nNo authentication or specific privileges are required to initiate the CreateMonitoredItems request sequence that triggers the flaw, widening the attack surface to any network-adjacent entity capable of reaching the OPC UA service."
}