Null Pointer Dereference in S2OPC Product by Systerel

CVE-2026-90782

What is CVE-2026-90782?

A null pointer dereference vulnerability exists in the S2OPC product, specifically in the msg_subscription_publish_bs__alloc_notification_message_items() function. This flaw allows an attacker to exploit heap allocation failures associated with sessions that manage both data-change and event notifications. When a data-change notification allocation fails, it is incorrectly overwritten by a successful allocation for an Event Notification List, leading to potential server process termination. Effective risk mitigation requires immediate attention and patching of S2OPC up to version 1.7.3.

References