{"id":"CVE-2026-90782","title":"S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificati…","summary":"S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificati…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"Systerel","product":"S2OPC","affected":["S2OPC <= 1.7.3"],"published":"2026-09-13","updated":"2026-09-14","sourceUpdated":"2026-09-14T18:20:26.747","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90782","references":[{"url":"https://gitlab.com/systerel/S2OPC","label":"disclosure@vulncheck.com"},{"url":"https://gitlab.com/systerel/S2OPC/-/blob/S2OPC_Toolkit_1.7.3/src/ClientServer/services/b2c/msg_subscription_publish_bs.c#L106-L147","label":"disclosure@vulncheck.com"},{"url":"https://gitlab.com/systerel/S2OPC/-/commit/8848f051eed069b107ae7cb16a346d6f6386a8f5","label":"disclosure@vulncheck.com"},{"url":"https://gitlab.com/systerel/S2OPC/-/issues/1815","label":"disclosure@vulncheck.com"},{"url":"https://gitlab.com/systerel/S2OPC/-/merge_requests/1862","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/s2opc-through-1.7.3-null-pointer-dereference-in-alloc-notification-message-items","label":"disclosure@vulncheck.com"},{"url":"https://gitlab.com/systerel/S2OPC/-/issues/1815","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T17:25:50.166515Z"},"epss":0.0032,"epssPercentile":0.25128,"exploits":{"github":1,"githubRepos":["https://github.com/HarshRajSinghania/CVE-2026-90782-s2opc-status-clobber"],"checkedAt":"2026-09-21T15:31:24.640Z"},"ingestedAt":"2026-09-14T15:23:07.470Z","slug":"CVE-2026-90782","body":"## Overview\n\nS2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":197651,"id":"CVE-2026-90782","ts":1789384317956,"field":"exploit_available","old":"false","new":"true"}]}