Out-of-Bounds Read Vulnerability in Systerel S2OPC by Systerel
CVE-2026-18790

4.8MEDIUM

Key Information:

Vendor: Systerel
Status: S2opc
Vendor: CVE Published:; 4 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18790?

A vulnerability has been identified in Systerel S2OPC versions up to 1.7.3, specifically affecting the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse function within the DeleteMonitoredItemsRequest Handler. This flaw leads to out-of-bounds read conditions, potentially allowing an attacker to manipulate data and access memory beyond allocated limits. The exploit requires local access to execute and has been publicly disclosed, raising concerns regarding the affected product's security. Despite contacting Systerel regarding this vulnerability, no response has been received, leaving users vulnerable to potential exploitation.

Affected Version(s)

S2OPC 1.7.0

S2OPC 1.7.1

S2OPC 1.7.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18790 - Proof of Concept