Description

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T13:16:29.410Z",
  "pubdate": "2026-09-13T13:16:29.410Z",
  "executiveSummary": "The S2OPC toolkit through version 1.7.3 contains a critical memory management flaw manifesting as a null pointer dereference within the subscription notification handling logic.\nThis vulnerability is rooted in an improper handling of heap allocation failures during the construction of OPC UA notification messages.\nAn attacker capable of initiating a session that triggers both DataChangeNotification and EventNotificationList can intentionally exhaust heap resources to induce allocation failures.\nThe improper overwriting of a failed DataChangeNotification allocation with a successful EventNotificationList allocation leads to a state where the system attempts to access or process a null pointer, resulting in a forced termination of the server process.\nThis vulnerability constitutes a Denial of Service (DoS) risk, as it allows unauthenticated or authenticated remote attackers to crash the service, disrupting availability for all users.\nThe vulnerability is limited to the server-side process, and its impact is primarily defined by service instability and potential process-level crashes, which could be exploited in environments requiring high availability.\nRemediation requires applying vendor-supplied patches that improve memory allocation safety and error-handling logic within the subscription management components.",
  "technicalDetails": "The vulnerability resides in the function msg_subscription_publish_bs__alloc_notification_message_items() within the S2OPC codebase, specifically in how the application manages memory for OPC UA subscription notifications.\nThe root cause is a logic error during the allocation phase of the notification message construction. When the application attempts to allocate memory for a DataChangeNotification, a memory exhaustion event can lead to a NULL return value from the allocator.\nDue to insufficient error checking in the subsequent logic flow, if a failed allocation for a DataChangeNotification occurs, the function proceeds to attempt an allocation for an EventNotificationList. If this second allocation is successful, the pointer associated with the failed DataChangeNotification is overwritten with the address of the successful EventNotificationList, or the logic incorrectly assumes the existence of the previously failed allocation.\nThe attack flow requires an attacker to establish a session with the S2OPC server that subscribes to both data-change and event notifications. By manipulating or flooding the server with specific request parameters, an attacker triggers a heap allocation failure at the critical moment of message construction.\nBecause the system fails to validate the return value of the initial allocation before proceeding, the application attempts to perform operations on a null or inconsistent pointer reference when the message is being populated or sent.\nThe lack of bounds checking or pointer state verification allows the process to dereference the NULL address, leading to an immediate segmentation fault and process crash.\nThis vulnerability is particularly impactful because it bypasses standard error recovery routines. Since the defect occurs within the subscription loop, it is repeatable, allowing an attacker to persistently crash the service. There is no requirement for high-level privileges beyond the ability to establish an OPC UA session, making it accessible from a remote network position.\nThe post-exploitation impact is a definitive service crash. While this is primarily a Denial of Service vulnerability, the underlying corruption of internal pointer states in a memory-managed environment suggests potential for further instability if the process were to continue execution, though the current manifestation is a predictable service termination."
}