CVE-2026-18790

LOW

Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds

Title source: cna
STIX 2.1

Description

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-385790 | Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds
https://vuldb.com/vuln/385790
Signature, Permissions Required signature permissions-required
VDB-385790 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/385790/cti
Third Party Advisory third-party-advisory
CVE-2026-18790 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-18790
Third Party Advisory third-party-advisory
Submit #857761 | Systerel S2OPC 1.7.3 Out-of-bounds Read
https://vuldb.com/submit/857761
Issue Tracking issue-tracking
https://github.com/gff-cw/information/issues/13

Scores

CVSS v3 3.3
EPSS 0.0012
EPSS Percentile 2.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-125
Status published
Products (4)
Systerel/S2OPC 1.7.0
Systerel/S2OPC 1.7.1
Systerel/S2OPC 1.7.2
Systerel/S2OPC 1.7.3
Published Aug 04, 2026
Tracked Since Aug 04, 2026