Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71256: nanoMODBUS: Malicious Server Can Write to Arbitrary Memory Locations
CVE-2026-71256
CVE-2026-71256
Summary
A vulnerability in nanoMODBUS versions 1.23.0 and earlier allows a malicious Modbus server to potentially write to any location in memory, leading to unintended behavior or data corruption. This issue can be exploited by a server that sends a specially crafted response. To protect against this vulnerability, update to a version of nanoMODBUS that has been patched.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debevv | nanomodbus | <= 1.23.0 |
Original title
nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id
Original description
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. When a malicious Modbus server sends a Read Device Identification response with object_id >= 3, this reads an out-of-bounds/garbage byte from the stack adjacent to order[], which is then used as an index into a 3-element buffers[] array of char* pointers. The resulting wild pointer is passed to strncpy() as the destination, causing an arbitrary-address write with server-controlled data.
nvd CVSS3.1
9.8
Vulnerability type
CWE-125
Out-of-bounds Read
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026