Out-Of-Bounds Write Vulnerability in nanoMODBUS by debevv

CVE-2026-71254

What is CVE-2026-71254?

The nanoMODBUS library version up to 1.23.0 is vulnerable to an out-of-bounds write due to inadequate validation of cumulative response sizes in the Modbus server's handle_read_file_record() function. The vulnerability arises when multiple sub-requests are processed, potentially allowing an unauthenticated network client to craft a malicious request that exceeds allocated buffer limits, leading to the corruption of adjacent memory. This can result in denial of service or, in certain scenarios, enable remote code execution on vulnerable embedded systems lacking memory protection.

References