by Kastro
Paper/Archive/CVE-2026-67868

CVE-2026-67868

mitre — A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems proc…

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.7.647 × 2012.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/gff-cw/information/issues/16refgithub.com/systerel/S2OPC/tree/S2OPC_Toolkit_1.7.3/samples/ClientServer/demo_server_alarmsrefgithub.com/systerel/S2OPC/blob/b4c5c7d63cd69698461d514b905a7c92b3c377c4/src/ClientServer/services/b2c/monitored_item_event_filter_where_clause_bs.crefgithub.com/systerel/S2OPC/blob/b4c5c7d63cd69698461d514b905a7c92b3c377c4/src/ClientServer/services/b2c/monitored_item_event_filter_treatment_bs.crefgitlab.com/systerel/S2OPC/-/work_items/1779