CVE-2026-11826: OpenPLC_v3 Buffer Overflow Vulnerability

CVE-2026-11826 Overview

CVE-2026-11826 is a heap-based buffer overflow [CWE-122] in OpenPLC_v3, an open-source programmable logic controller (PLC) runtime. The flaw resides in the getData() function in webserver/core/modbus_master.cpp, which reads bytes between delimiters into a caller-supplied buffer without a size parameter or bounds check. An authenticated attacker with access to the OpenPLC web interface can submit a crafted HTTP POST to the /modbus endpoint containing an oversized device_name value. The value is persisted to mbconfig.cfg and parsed on load, corrupting adjacent heap structure fields. The upstream repository was archived on 2026-04-04 and no fix is planned.

Critical Impact
A 200-byte payload writes 100 bytes past the dev_name allocation, overwriting protocol, dev_address, and ip_port fields and crashing the PLC process control loop.

Affected Products

OpenPLC_v3 (all versions, upstream repository archived)
webserver/core/modbus_master.cpp component
OpenPLC Runtime v4 is NOT affected (per vendor confirmation)

Discovery Timeline

2026-04-04 - Upstream OpenPLC_v3 repository archived by maintainer
2026-07-18 - CVE-2026-11826 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-11826

Vulnerability Analysis

The vulnerability originates in the getData() helper used by the Modbus master configuration parser. getData() accepts a destination buffer pointer but no length argument, and copies characters between two delimiter markers into that buffer until the closing delimiter is reached. This design places all responsibility for size checking on callers, and parseConfig() provides none.

parseConfig() calls getData() with the address of MB_device.dev_name, a fixed 100-byte field inside a heap-allocated struct. When the persisted device_name in mbconfig.cfg exceeds 100 bytes, the copy continues past the field boundary. Adjacent members are protocol at offset 108, dev_address at offset 109, and ip_port at offset 210. Attacker-supplied bytes deterministically overwrite these fields.

Root Cause

The root cause is missing bounds validation in getData() combined with a caller contract that assumes trusted input. The function signature omits the destination size, making safe use impossible without external length tracking. Configuration data written through the web UI is treated as trusted and re-parsed on service load, converting a web input into a memory corruption primitive.

Attack Vector

An authenticated user sends an HTTP POST to /modbus with a device_name parameter longer than 100 bytes. The webserver writes the value to mbconfig.cfg without length restriction. On the next configuration load, parseConfig() invokes getData() against the oversized value and overflows dev_name. The overwrite corrupts control-flow-adjacent configuration fields, producing heap corruption, a runtime crash, and denial of service of the PLC control loop.

/*     GT     */
/**************/
/* Comparison for numerical data types */
__compare_num(GT_BOOL, BOOL, > )  /* The explicitly typed standard functions */
__compare_num(GT__BOOL__BOOL, BOOL, > ) /* Overloaded function */
#define __iec_(TYPENAME) \
__compare_num(GT_##TYPENAME, TYPENAME, > ) /* The explicitly typed standard functions */\
__compare_num(GT__BOOL__##TYPENAME, TYPENAME, > ) /* Overloaded function */

Source: GitHub Commit b4702061 — this commit addresses an unrelated BOOL comparison issue in iec_std_functions.h and does not remediate the getData() overflow.

Detection Methods for CVE-2026-11826

Indicators of Compromise

mbconfig.cfg files containing device_name values longer than 100 bytes
Unexpected OpenPLC runtime crashes or segmentation faults on configuration load
HTTP POST requests to /modbus with abnormally long device_name form fields
Modification of mbconfig.cfg outside of scheduled configuration changes

Detection Strategies

Inspect web server access logs for POST requests to /modbus and flag payloads where the device_name parameter exceeds 100 bytes.
Monitor the mbconfig.cfg file for content anomalies, size growth, or non-ASCII sequences in device name fields.
Correlate authenticated OpenPLC session activity with subsequent process crashes to identify exploitation attempts.

Monitoring Recommendations

Enable file integrity monitoring on mbconfig.cfg and related OpenPLC configuration paths.
Capture process exit codes and core dumps from the OpenPLC runtime to detect heap corruption crashes.
Log all authentication events for the OpenPLC web interface and alert on new administrative sessions from unexpected sources.

How to Mitigate CVE-2026-11826

Immediate Actions Required

Migrate to OpenPLC Runtime v4, which the vendor has confirmed is not affected by this vulnerability.
Restrict network access to the OpenPLC web interface using firewall rules or a management VLAN so only trusted operators can reach /modbus.
Rotate credentials for all OpenPLC web interface accounts and remove unused accounts.
Validate the contents of mbconfig.cfg on all deployed instances and truncate any device_name value longer than 100 bytes.

Patch Information

No upstream patch is available. The thiagoralves/OpenPLC_v3 repository was archived on 2026-04-04 and the maintainer has indicated no fix will be released. The vendor recommends migration to OpenPLC Runtime v4. See the VulnCheck Advisory on OpenPLC and the GitHub Security Vulnerability Report for additional detail.

Workarounds

Place the OpenPLC web interface behind a reverse proxy that enforces a maximum request body size and rejects device_name values over 100 bytes.
Set mbconfig.cfg to read-only for the OpenPLC service account after applying a validated configuration.
Disable the Modbus master configuration UI where operational requirements permit.
Segment PLC hosts on an isolated OT network with no direct exposure to corporate or internet-facing zones.

bash

# Example nginx reverse proxy rule to cap request body size for /modbus
location /modbus {
    client_max_body_size 2k;
    proxy_pass http://127.0.0.1:8080;
}

# Enforce read-only mbconfig.cfg after configuration is finalized
chown root:openplc /var/openplc/mbconfig.cfg
chmod 0440 /var/openplc/mbconfig.cfg