{"id":"CVE-2026-90782","summary":"S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()","details":"S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions with both data-change and event notifications to cause the server process to terminate.","modified":"2026-09-16T08:09:46.416673Z","published":"2026-09-13T12:22:01.806Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90782.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90782.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90782"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/s2opc-through-1.7.3-null-pointer-dereference-in-alloc-notification-message-items"},{"type":"REPORT","url":"https://gitlab.com/systerel/S2OPC/-/issues/1815"},{"type":"FIX","url":"https://gitlab.com/systerel/S2OPC/-/commit/8848f051eed069b107ae7cb16a346d6f6386a8f5"},{"type":"FIX","url":"https://gitlab.com/systerel/S2OPC/-/merge_requests/1862"},{"type":"PACKAGE","url":"https://gitlab.com/systerel/S2OPC"},{"type":"ARTICLE","url":"https://gitlab.com/systerel/S2OPC/-/blob/S2OPC_Toolkit_1.7.3/src/ClientServer/services/b2c/msg_subscription_publish_bs.c#L106-L147"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/systerel/S2OPC","events":[{"introduced":"0"},{"fixed":"8848f051eed069b107ae7cb16a346d6f6386a8f5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.7.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["S2OPC_LibSub_0.1.3","S2OPC_LibSub_0.1.2","S2OPC_PubSub_0.2.0","S2OPC_PubSub_0.1.0","S2OPC_LibSub_0.0.2e","S2OPC_LibSub_0.0.2d","S2OPC_LibSub_0.0.2c","S2OPC_LibSub_0.0.2b","Version_Schneider_ClockWork"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/systerel/S2OPC@8848f051eed069b107ae7cb16a346d6f6386a8f5","target":{"file":"src/ClientServer/services/b2c/msg_subscription_publish_bs.c"},"deprecated":false,"digest":{"line_hashes":["267434289667783062172027766477893675357","162307337802656131982794424823855339668","288814776294781444704073730711806677128","192801580654839292751431697967038442681","47819597508775867248455719652207020172","209053912494654477757136134681134881991","65529608612764284094908761609133252869","146325353456770940215568559260577929693"],"threshold":0.9},"id":"CVE-2026-90782-cbc8d23d"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90782.json","vanir_signatures_modified":"2026-09-16T08:09:46Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}