NULL Pointer Dereference Vulnerability in S2OPC

CVE-2026-90782 is a memory-related vulnerability in S2OPC (Safe & Secure OPC) versions 1.7.3 and earlier. The flaw resides within the alloc_notification_message_items() function, where a single shared status variable is reused for both DataChange and Event memory allocations. An error in the allocation logic allows the status variable to be incorrectly overwritten to SOPC_STATUS_OK if a DataChange allocation fails but a subsequent Event allocation succeeds. This logic failure causes the application to bypass safety checks and proceed to dereference a NULL pointer (dataChangeNotif), resulting in a crash and denial-of-service condition for the affected service. A public proof-of-concept (PoC) exploit has been released, demonstrating the crash by manipulating the allocation failure path.

Impact

The vulnerability results in an application-level denial-of-service (DoS) condition. As the target is an OPC UA stack, successful exploitation can lead to loss of availability for critical industrial communication services, potentially disrupting process monitoring or control functions in environments where S2OPC is deployed.

Recommendation

Prioritize the identification and patching of S2OPC instances.

• Upgrade all deployments of S2OPC to the version containing the fix for CVE-2026-90782 (referencing the logic pattern in commit 8848f051).
• Review industrial network monitoring logs for service instability or recurring crashes associated with OPC UA services.
• Implement memory safety monitoring tools like AddressSanitizer (ASan) in development and staging environments to proactively detect memory corruption or NULL dereference vulnerabilities.