CVE-2026-71256
Received Received - Intake

Stack Out-of-Bounds Write in nanoMODBUS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. When a malicious Modbus server sends a Read Device Identification response with object_id >= 3, this reads an out-of-bounds/garbage byte from the stack adjacent to order[], which is then used as an index into a 3-element buffers[] array of char* pointers. The resulting wild pointer is passed to strncpy() as the destination, causing an arbitrary-address write with server-controlled data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71256
EUVD
EUVD-2026-53333

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
debevv nanomodbus From 1.0.0 (inc) to 1.23.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds stack read in nanoMODBUS through v1.23.0 that leads to a wild-pointer write. The issue occurs in the function nmbs_read_device_identification_basic() / recv_read_device_identification_res() where a 3-element stack array maps object IDs to buffer indices. A malicious Modbus server can send a Read Device Identification response with an object_id value greater than or equal to 3, causing an out-of-bounds read from the stack. This garbage value is then used as an index into a 3-element buffers array, resulting in an arbitrary-address write with server-controlled data.

Detection Guidance

Detecting this vulnerability requires monitoring Modbus traffic for Read Device Identification responses with object_id values greater than or equal to 3. Use network sniffing tools like tcpdump or Wireshark to capture Modbus TCP/RTU traffic and filter for function code 0x2B (Read Device Identification) with invalid object IDs.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service by exploiting the wild-pointer write. Since the attack is triggered by a malicious Modbus server, any system using the vulnerable nanoMODBUS library to communicate with Modbus devices could be affected. The high CVSS score (9.8) indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or system disruption, which may violate compliance requirements under GDPR (data protection), HIPAA (healthcare data security), and other regulations. The high impact on confidentiality and integrity means organizations could face legal penalties or data breach notifications if exploited.

Mitigation Strategies

Immediately update nanoMODBUS to the latest patched version (v1.23.1 or later). If updating is not possible, implement strict input validation to reject Read Device Identification responses with object_id >= 3. Disable Modbus Read Device Identification functionality if unused. Monitor network traffic for suspicious Modbus responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart