CVE-2026-71254
CriticalCVSS 9.8Summary
nanoMODBUS through v1.23.0 has an out-of-bounds write in handle_read_file_record() (FC 0x14). The function does not validate the cumulative response size, and the response_data_size accumulator is uint8_t, so with 35 sub-requests of record_length=124, it overflows and writes ~8490 bytes past the 260-byte buffer. A single FC 0x14 request can lead to DoS or RCE.
Risk Assessment
An unauthenticated attacker can cause memory corruption in the server process, potentially leading to crashes or remote code execution. Especially dangerous in embedded systems without memory protection.
Recommendation
Update nanoMODBUS to a patched version or validate the cumulative response size before processing.
Original NVD description (English source)
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record() function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them. The accumulator response_data_size is declared as uint8_t and is incremented by 2 + record_length*2 for each of up to 35 sub-requests; with 35 sub-requests of record_length=124, the cumulative demand is 8750 bytes, which overflows the uint8_t accumulator. A subsequent loop then calls get_n(), an internal function with no bounds checking, once per sub-request to obtain a pointer into the 260-byte msg.buf receive buffer and advances the internal buf_idx by up to 248 bytes per call; swap_regs() then writes to that pointer unconditionally. A single crafted FC 0x14 request from an unauthenticated network client can cause up to ~8490 bytes to be written out of bounds past the 260-byte buffer, corrupting adjacent memory in the server process and leading to denial of service or potential remote code execution, particularly on embedded/bare-metal targets without memory protection.