CVE-2026-71255: nanoMODBUS Buffer Overflow Vulnerability

CVE-2026-71255 Overview

CVE-2026-71255 is an out-of-bounds write vulnerability in the nanoMODBUS library through version 1.23.0. The flaw resides in the client-side recv_read_device_identification_res() function in nanomodbus.c, which handles Modbus function code 0x2B / MEI type 0x0E (Read Device Identification) responses. A malicious or compromised Modbus server can send a crafted response that causes the client to write a NUL byte past the end of a caller-provided buffer. This corrupts adjacent stack or heap memory on the client, enabling denial of service and potentially memory corruption attacks against industrial control system endpoints [CWE-787].

Critical Impact
A malicious Modbus server can corrupt client memory by returning a object_length value equal to or greater than the client's buffers_length, leading to crashes or exploitable heap and stack corruption.

Affected Products

nanoMODBUS library versions through 1.23.0
Modbus client applications linking nanomodbus.c
Embedded and industrial control systems using nanoMODBUS as a Modbus client

Discovery Timeline

2026-08-05 - CVE-2026-71255 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71255

Vulnerability Analysis

The defect lives in the client response handler for Read Device Identification. When the client parses server-returned objects, it reads the object_length field from the PDU. The library validates object_length (which can range from 0 to 246) only against res_size_left, the remaining bytes in the PDU. It never compares object_length against buffers_length, the size of the caller-supplied output buffer.

After copying the object string with strncpy(buffers_out[buf_index], str, buffers_length), the code unconditionally writes a NUL terminator at buffers_out[buf_index][object_length]. If object_length is greater than or equal to buffers_length, the terminator lands outside the destination buffer. The attacker controls both the byte value (always 0x00) and, through object_length, the offset up to 246 bytes past the buffer.

Root Cause

The root cause is missing bounds validation between attacker-controlled protocol data and caller-supplied buffer geometry. The developer assumed res_size_left alone was a sufficient sanity check for object_length. That assumption breaks when the client passes buffers smaller than the maximum Modbus object size of 246 bytes.

Attack Vector

Exploitation requires the victim to act as a Modbus client and connect to an attacker-controlled or compromised Modbus server. The attacker responds to a Read Device Identification request with a crafted PDU where object_length exceeds the client's buffers_length. Modbus/TCP typically runs on TCP port 502 and is often exposed on operational technology networks. No authentication is required by the Modbus protocol itself.

See the nanoMODBUS source file for the vulnerable function implementation.

Detection Methods for CVE-2026-71255

Indicators of Compromise

Modbus/TCP responses on port 502 containing function code 0x2B with MEI type 0x0E where the object_length field exceeds expected client buffer sizes
Unexpected crashes, segmentation faults, or heap corruption reports in applications linking nanoMODBUS
Modbus client processes terminating shortly after issuing Read Device Identification requests to remote servers

Detection Strategies

Deploy network intrusion detection signatures that inspect Modbus function code 0x2B responses and flag object_length values approaching the protocol maximum of 246
Perform binary and source dependency scanning to identify applications statically linking nanomodbus.c at or below version 1.23.0
Monitor endpoint telemetry for abnormal termination or memory corruption exceptions in ICS/SCADA client processes

Monitoring Recommendations

Log and alert on all outbound Modbus/TCP sessions from engineering workstations and historians to untrusted networks
Correlate Modbus client crashes with recent inbound responses containing FC 0x2B / MEI 0x0E payloads
Track new or unexpected Modbus server endpoints that clients connect to, especially those outside the segmented OT network

How to Mitigate CVE-2026-71255

Immediate Actions Required

Inventory all software that embeds nanoMODBUS 1.23.0 or earlier and restrict its Read Device Identification usage until patched
Segment Modbus clients so they can only reach authenticated, trusted Modbus servers
Ensure caller-supplied buffers_length is at least 247 bytes as a defensive measure until an upstream fix is applied

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Monitor the nanoMODBUS GitHub repository for a patched release addressing the missing buffers_length validation in recv_read_device_identification_res().

Workarounds

Avoid calling the Read Device Identification API (nmbs_read_device_identification) against untrusted servers
Apply a local source patch that validates object_length < buffers_length before writing the NUL terminator in recv_read_device_identification_res()
Enforce firewall rules restricting TCP port 502 traffic to known-good server addresses only

bash

# Example iptables rule restricting Modbus/TCP client sessions to a trusted server
iptables -A OUTPUT -p tcp --dport 502 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 502 -j DROP