CVE-2026-82619: Systerel S2OPC subscription_mgr.c use after free
A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitoreditemeventfiltertreatmentbsiniteventfilterctxandresult of the file src/ClientServer/services/bgenc/subscriptionmgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is a4cee16a851b971be447a6ed531173702c722b99. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Systerel S2OPCto a version that resolves this vulnerability.Fixed in 1.7.3Patch a4cee16a851b971be447a6ed531173702c722b99
Event History
Frequently Asked Questions
Which deployments are affected?
Systerel S2OPC versions up to and including 1.7.3 are affected. The vulnerable code is in the ClientServer subscription manager implementation.
What access does an attacker need?
The issue can be exploited remotely with low attack complexity, but the supplied severity vector indicates that the attacker needs low-level privileges. Exploitation involves manipulation of the EventFilter argument.
Is exploit code available?
Yes. The available data states that an exploit is publicly available, increasing the likelihood that the issue could be used against exposed affected deployments.
What should teams do to remediate the issue?
Apply the patch identified as a4cee16a851b971be447a6ed531173702c722b99. The provided data does not specify an alternative mitigation when patching cannot be performed immediately.