CVE-2026-29972
HighSummary
nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. An attacker can send a malicious response from a Modbus TCP server, leading to buffer overflow and potential remote code execution.
Risk Assessment
This vulnerability could allow an attacker to execute code remotely, posing a serious security risk to systems using this library.
Recommendation
It is recommended to update nanoMODBUS to the latest version to mitigate this vulnerability and implement additional response validation mechanisms.
Other vulnerabilities in nanoMODBUS
See all- CVE-2026-71256Critical
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].
- CVE-2026-71254Critical
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.
- CVE-2026-71255High
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
- CVE-2026-54410High
Off-by-one buffer overflow vulnerability in nanoMODBUS through v1.23.0 in the recv_msg_header function of the Modbus/TCP server. A remote unauthenticated attacker can write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame with the Length field set to 255.
Original NVD description (English source)
nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. When a client calls nmbs_read_holding_registers() or nmbs_read_input_registers(), the library writes register data from the server response to the caller-provided buffer based on the response's byte_count field before validating that byte_count matches the requested quantity. A malicious Modbus TCP server can send a response with byte_count=250 (125 registers) regardless of the requested quantity, causing up to 248 bytes of attacker-controlled data to overflow the buffer, potentially allowing remote code execution.