CVE-2026-71254
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.
Risk Assessment
An attacker can send a specially crafted Modbus request that causes an out-of-bounds write, potentially leading to system crash or remote code execution.
Recommendation
Update nanoMODBUS to the latest version. Also add validation of the cumulative response size in the code.
Other vulnerabilities in nanoMODBUS
See all- CVE-2026-29972High
nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. An attacker can send a malicious response from a Modbus TCP server, leading to buffer overflow and potential remote code execution.
- CVE-2026-71256Critical
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].
- CVE-2026-71255High
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
- CVE-2026-54410High
Off-by-one buffer overflow vulnerability in nanoMODBUS through v1.23.0 in the recv_msg_header function of the Modbus/TCP server. A remote unauthenticated attacker can write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame with the Length field set to 255.
Original NVD description (English source)
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.