Description

A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result of the file src/ClientServer/services/bgenc/subscription_mgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is a4cee16a851b971be447a6ed531173702c722b99. It is best practice to apply a patch to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T06:17:07.857Z",
  "pubdate": "2026-08-31T06:17:07.857Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified in Systerel S2OPC versions up to 1.7.3. The flaw resides within the event filtering logic of the subscription manager. An attacker can trigger this memory corruption remotely, potentially leading to arbitrary code execution or a denial-of-service condition. The vulnerability arises from improper handling of the EventFilter argument within the subscription processing lifecycle. Given the availability of public exploits, the risk to impacted systems is significant, necessitating immediate remediation. Exposure is primarily network-based, allowing unauthenticated or remote actors to interact with the service and manipulate internal memory state. Successful exploitation may result in full system compromise depending on the process privileges and memory layout randomization status of the target host.",
  "technicalDetails": "The vulnerability is located in the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result, defined in src/ClientServer/services/bgenc/subscription_mgr.c. The root cause is a memory management error involving the EventFilter structure during the initialization of the event filter context. Specifically, the software fails to properly manage the lifecycle of the memory allocated for the EventFilter object, leading to a condition where a pointer remains valid for use after the underlying memory has been deallocated or freed.\nThe attack flow initiates when a remote client sends a specially crafted request involving an EventFilter to the S2OPC service. The subscription manager processes this request, triggering the vulnerable function. During the sequence of operations within monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result, the application creates an event filter context. Due to logic flaws in how the context and its associated result structures are handled, the system may prematurely free the memory associated with the filter argument while subsequent operations continue to reference it.\nBecause the reference is not cleared or nullified following the free operation, the system enters a dangling pointer state. A remote attacker can leverage heap grooming or spraying techniques to fill the vacated memory location with malicious data. When the application subsequently attempts to perform operations on the dangling pointer—such as reading or writing to the filter context—it inadvertently utilizes the attacker-controlled memory. This leads to undefined behavior, which can be leveraged to redirect execution flow.\nThe impact of this vulnerability is severe. By manipulating the contents of the freed memory, an attacker can overwrite critical function pointers, return addresses, or object metadata, facilitating arbitrary code execution. If code execution is not directly achieved, the corruption of internal object structures typically results in a process crash, leading to a denial-of-service. The vulnerability is exploitable remotely, does not necessarily require prior authentication, and exploits are already publicly available, significantly increasing the probability of active exploitation in the wild. The logic error persists throughout the entire S2OPC product line for all versions up to 1.7.3."
}