Out-of-Bounds Write in nanoMODBUS Client-side Function

CVE-2026-71255

What is CVE-2026-71255?

The nanoMODBUS library prior to version 1.23.0 contains an out-of-bounds write vulnerability in the recv_read_device_identification_res() function. This issue arises due to inadequate validation of the server-supplied object_length field against the caller-provided buffers_length parameter. When a malicious Modbus server sends a response with an object_length that exceeds the size of the client's buffer, it leads to memory corruption by writing a NUL terminator past the buffer's allocated memory, potentially overwriting adjacent memory segments.

References