CVE-2026-71255
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
Risk Assessment
A remote Modbus server can cause an out-of-bounds write in the client, potentially leading to crashes or arbitrary code execution on the client system.
Recommendation
Update the nanoMODBUS library to a version that properly validates object_length against the buffer size, or apply a workaround by manually checking response lengths.
Other vulnerabilities in nanoMODBUS
See all- CVE-2026-29972High
nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. An attacker can send a malicious response from a Modbus TCP server, leading to buffer overflow and potential remote code execution.
- CVE-2026-71256Critical
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].
- CVE-2026-71254Critical
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.
- CVE-2026-54410High
Off-by-one buffer overflow vulnerability in nanoMODBUS through v1.23.0 in the recv_msg_header function of the Modbus/TCP server. A remote unauthenticated attacker can write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame with the Length field set to 255.
Original NVD description (English source)
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.