An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling

CVE-2026-67872 is a denial-of-service vulnerability identified in Systerel S2OPC version 1.7.3, an OPC-UA toolkit. A remote attacker can exploit a flaw in the event monitored-item queue resize handling to cause a denial of service. The vulnerability exists in the monitored item notification queue and subscription core components of the ClientServer module. Reference source files implicated include monitored_item_notification_queue_bs.c and subscription_core.c. A validation test case for modifying event queues is also referenced, suggesting the issue was identified during testing. The issue is tracked internally by Systerel via GitLab work item #1788. No authentication bypass or code execution has been noted; the primary impact is service availability. The vulnerability affects OPC-UA server implementations using the S2OPC toolkit, which is commonly used in industrial and critical infrastructure environments.