CVE-2026-71255 in nanoMODBUS
Summary
by MITRE • 08/05/2026
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res() function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter. After copying data with strncpy(buffers_out[buf_index], str, buffers_length), the code unconditionally writes a NUL terminator at buffers_out[buf_index][object_length]. When a malicious or compromised Modbus server sends a response with object_length greater than or equal to the client's buffers_length, this NUL write lands past the end of the caller-provided buffer, corrupting adjacent stack or heap memory on the client.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The nanoMODBUS library version 1.23.0 contains a critical out-of-bounds write vulnerability in its Modbus client implementation that poses significant security risks to industrial control systems and networked devices relying on this communication protocol. This flaw exists within the recv_read_device_identification_res() function responsible for processing Modbus function code 0x2B with MEI type 0x0E, which is used to read device identification information from Modbus servers. The vulnerability stems from inadequate input validation mechanisms that fail to properly constrain the object_length field received from remote servers against the client-side buffer boundaries.
The technical flaw manifests through a classic buffer overflow condition where the software performs insufficient boundary checking on the object_length parameter provided by the server. While the code validates this field against the remaining PDU size, it completely neglects to verify that object_length does not exceed the buffers_length parameter supplied by the caller. This validation gap creates an exploitable condition where malicious actors can craft specially crafted Modbus responses designed to trigger memory corruption. The vulnerability occurs during the string copy operation using strncpy followed by an unconditional NUL terminator write at buffers_out[buf_index][object_length], which effectively writes beyond the allocated buffer boundaries when object_length equals or exceeds buffers_length.
The operational impact of this vulnerability extends beyond simple memory corruption, representing a serious threat to industrial systems that depend on nanoMODBUS for communication between controllers, sensors, and monitoring devices. Attackers exploiting this flaw could potentially achieve arbitrary code execution, system crashes, or data manipulation within affected client applications that utilize the library. The vulnerability affects any system where nanoMODBUS is integrated into Modbus client implementations, particularly those in critical infrastructure sectors such as power grid management, water treatment facilities, manufacturing processes, and other industrial automation environments. According to CWE classification, this represents a CWE-787: Out-of-bounds Write vulnerability that specifically targets buffer boundary conditions in network protocol implementations.
From an adversarial perspective, this vulnerability aligns with ATT&CK technique T1059.007 for command and control communication through protocol manipulation, as attackers could exploit it to compromise Modbus client systems within industrial networks. The attack surface is particularly concerning given that Modbus protocols often operate in environments with limited network segmentation and monitoring capabilities, making exploitation more likely to go undetected. Security professionals should consider this vulnerability alongside other industrial protocol vulnerabilities that could enable lateral movement or persistent access within operational technology networks.
Mitigation strategies must address both immediate remediation and long-term architectural improvements in Modbus client implementations. The most effective immediate solution involves patching the nanoMODBUS library to version 1.24.0 or later, which includes proper bounds checking for object_length against buffers_length parameters. Organizations should also implement network monitoring solutions capable of detecting anomalous Modbus responses with suspiciously large object_length fields, as well as establish proper input validation controls at the application layer where nanoMODBUS is integrated. Additionally, system architects should consider implementing defensive programming practices that enforce strict buffer boundaries and employ memory protection mechanisms such as stack canaries or address space layout randomization to mitigate potential exploitation attempts.