CVE-2026-90782 — S2OPC Status-Clobbering NULL Dereference

Standalone proof-of-concept for CVE-2026-90782 in S2OPC (Safe & Secure OPC).

Vulnerability

In alloc_notification_message_items() (S2OPC 1.7.3 and earlier):

• A single shared status variable is used for both DataChange and Event allocations.
• If the DataChange allocation fails (returns OOM / non-OK) but the subsequent Event allocation succeeds, status is overwritten to SOPC_STATUS_OK.
• The post-loop guard then passes and the code dereferences the still-NULL dataChangeNotif pointer → NULL dereference / crash.

Build & Run

gcc -o s2opc_poc reproducer.c

# Test 1 — both allocations succeed (no crash)
./s2opc_poc 1

# Test 2 — vulnerable path: DataChange fails, Event succeeds → NULL deref (crash)
./s2opc_poc 2

# Test 3 — fixed path: independent status tracking, no crash
./s2opc_poc 3

# Test 4 — control: data-only (no Event alloc to clobber status)
./s2opc_poc 4

Recommended with AddressSanitizer:

gcc -fsanitize=address -g -o s2opc_poc reproducer.c
./s2opc_poc 2

Fix

Track allocation statuses independently and early-exit / skip the dereference when DataChange allocation failed. Mirrors the pattern in commit 8848f051.

Files

• reproducer.c — mirrors the vulnerable and fixed allocation logic