CVE-2026-29972 Details

A stack-based buffer overflow vulnerability has been identified in the nanoMODBUS library, specifically in versions through 1.22.0. The issue arises in the function recv_read_registers_res() within nanomodbus.c. When a client uses the library to read holding or input registers, the library writes the received register data into a user-provided buffer. This is done based on the byte_count field of the response, but without first verifying that the byte_count aligns with the amount of data requested. As a result, a malicious Modbus TCP server can exploit this by sending a response with a fabricated byte_count value, leading to an overflow of the buffer with attacker-controlled data. This vulnerability could potentially be exploited to execute remote code.