CVE-2026-71256
CriticalCVSS 9.8Summary
nanoMODBUS through v1.23.0 has an out-of-bounds stack read and wild-pointer write in nmbs_read_device_identification_basic() and recv_read_device_identification_res(). The server-supplied object_id (0-255) is used as an index into the 3-element order[] array, and when object_id >= 3, it reads garbage from the stack, which is then used as an index into a pointer array, leading to an arbitrary-address write.
Risk Assessment
A malicious Modbus server can cause a write to an arbitrary address in the process memory, potentially leading to crashes or remote code execution. This may compromise embedded systems.
Recommendation
Update nanoMODBUS to a patched version or validate object_id before using it as an index.
Original NVD description (English source)
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. When a malicious Modbus server sends a Read Device Identification response with object_id >= 3, this reads an out-of-bounds/garbage byte from the stack adjacent to order[], which is then used as an index into a 3-element buffers[] array of char* pointers. The resulting wild pointer is passed to strncpy() as the destination, causing an arbitrary-address write with server-controlled data.