CVE-2026-71255

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1

Description An out-of-bounds write exists in the Modbus client-side recv read device identification res() function (FC 0x2B/MEI 0x0E, Read Device Identification) within nanomodbus.c. The issue occurs because the server-supplied object length field is validated against the remaining PDU size but not against the caller-supplied buffers length parameter. After data is copied using strncpy(), the code writes a NUL terminator at buffers out[buf index][object length]. If a compromised Modbus server provides an object length greater than or equal to the buffers length, the NUL terminator is written beyond the buffer boundary, leading to the corruption of adjacent stack or heap memory on the client.

Recommendations Update nanoMODBUS to a version later than 1.23.0. As a temporary workaround, restrict the use of the recv read device identification res() function to minimize the risk of exploitation.