CVE-2026-71255: nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres() function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied objectlength field (0-246) is validated only against the remaining PDU size (ressizeleft) and is never validated against the caller-supplied bufferslength parameter. After copying data with strncpy(buffersout[bufindex], str, bufferslength), the code unconditionally writes a NUL terminator at buffersout[bufindex][objectlength]. When a malicious or compromised Modbus server sends a response with objectlength greater than or equal to the client's bufferslength, this NUL write lands past the end of the caller-provided buffer, corrupting adjacent stack or heap memory on the client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71255?
CVE-2026-71255 has a severity score of 8.2, indicating a high level of risk.
How do I fix CVE-2026-71255?
To remediate CVE-2026-71255, update to the latest version of nanoMODBUS that addresses the out-of-bounds write vulnerability.
What type of vulnerability is CVE-2026-71255?
CVE-2026-71255 is an out-of-bounds write vulnerability that affects the client-side of the nanoMODBUS implementation.
What software is impacted by CVE-2026-71255?
CVE-2026-71255 impacts nanoMODBUS versions prior to 1.23.0.
What could be the consequences of CVE-2026-71255?
Exploitation of CVE-2026-71255 could lead to crashes or potentially allow an attacker to execute arbitrary code on the system.