Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71256: nanoMODBUS: Malicious Server Can Write to Arbitrary Memory Locations
CVE-2026-71256 · published 3 months ago
Summary
A vulnerability in nanoMODBUS versions 1.23.0 and earlier allows a malicious Modbus server to potentially write to any location in memory, leading to unintended behavior or data corruption. This issue can be exploited by a server that sends a specially crafted response. To protect against this vulnerability, update to a version of nanoMODBUS that has been patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debevv | nanomodbus | <= 1.23.0 |
Original advisory text
nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].
References
- https://github.com/debevv/nanoMODBUS Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71256... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-71256 Vendor Advisory
- https://github.com/debevv/nanoMODBUS/blob/master/nanomodbus.c Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-125Out-of-bounds Read
Timeline
Published5 Aug 2026
Updated4 Nov 2026
First seen5 Aug 2026
Track software like this
Free during beta