CVE-2026-71254

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1

Description An out-of-bounds write exists in the server-side handle read file record() function (FC 0x14, Read File Record) within nanomodbus.c. While the function validates the total request size and individual sub-request record length, it fails to validate the cumulative response size across all sub-requests. The response data size accumulator, declared as uint8 t, can overflow when processing up to 35 sub-requests. This allows a subsequent loop to call get n() and swap regs(), which writes data unconditionally to a pointer derived from the 260-byte msg.buf receive buffer. An unauthenticated network client can send a crafted FC 0x14 request to write approximately 8490 bytes beyond the buffer, potentially leading to memory corruption, denial of service, or remote code execution, especially on embedded or bare-metal systems lacking memory protection.

Recommendations Update nanoMODBUS to a version later than 1.23.0. As a temporary workaround, restrict network access to the Modbus server to trusted clients only to prevent unauthenticated requests.