CVE-2026-90782

S2OPC through version 1.7.3 contains a null pointer dereference (CWE-476) in msg_subscription_publish_bs__alloc_notification_message_items(), a code path that builds publish notifications for OPC UA subscriptions. If the heap allocation for a DataChangeNotification fails, the error state is clobbered by a subsequent successful allocation for an EventNotificationList, so the original failure goes unhandled and the null pointer is later dereferenced, terminating the server process. An authenticated attacker (PR:L) on a session with both data-change and event subscriptions can deliberately induce heap allocation failures — for example via memory exhaustion — to crash the server, affecting only availability (VA:H, CVSS 4.0 medium, 6.0). Anyone operating an S2OPC-based OPC UA server at or below 1.7.3 is affected, which is common in industrial and embedded deployments. A public PoC exists on GitHub, but the flaw is not in the CISA KEV catalog and there are no reports of in-the-wild exploitation.

What to do: Upgrade to a S2OPC release newer than 1.7.3 as soon as the vendor ships a fix, since no fixed version is listed in the current advisory. In the interim, restrict OPC UA access (TCP 4840 and secure endpoints) to trusted engineering networks, enforce authentication with least-privilege user roles so untrusted clients cannot hold subscriptions, and monitor server memory usage and process restarts for signs of heap-exhaustion DoS. Validate that no internet-facing S2OPC servers expose sessions combining data-change and event subscriptions to untrusted users.