Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

CVE-2026-71256: nanoMODBUS: Malicious Server Can Write to Arbitrary Memory Locations

CVE-2026-71256 CVE-2026-71256
Summary

A vulnerability in nanoMODBUS versions 1.23.0 and earlier allows a malicious Modbus server to potentially write to any location in memory, leading to unintended behavior or data corruption. This issue can be exploited by a server that sends a specially crafted response. To protect against this vulnerability, update to a version of nanoMODBUS that has been patched.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
debevv nanomodbus <= 1.23.0
Original title
nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id
Original description
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. When a malicious Modbus server sends a Read Device Identification response with object_id >= 3, this reads an out-of-bounds/garbage byte from the stack adjacent to order[], which is then used as an index into a 3-element buffers[] array of char* pointers. The resulting wild pointer is passed to strncpy() as the destination, causing an arbitrary-address write with server-controlled data.
nvd CVSS3.1 9.8
Vulnerability type
CWE-125 Out-of-bounds Read
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026