CVE-2026-71255 Details
Description
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
A vulnerability allowing an out-of-bounds write has been identified in nanoMODBUS versions through 1.23.0. The issue arises in the Modbus client function 'recv_read_device_identification_res()', which handles the 'Read Device Identification' function code. The vulnerability occurs because the library fails to properly validate the length of data received from the server against the length of the buffers provided by the caller. This oversight allows a malicious Modbus server to send a response that exceeds the capacity of the client's buffer, leading to memory corruption by overwriting adjacent stack or heap memory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/debevv/nanoMODBUS | TuranSec | ProductVendor |
| https://github.com/debevv/nanoMODBUS/blob/master/nanomodbus.c | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| debevv nanoMODBUS | <= 1.23.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |