CVE-2026-71256 Details

A vulnerability in nanoMODBUS versions through 1.23.0 allows for an out-of-bounds stack read, which can lead to a wild-pointer write. This issue occurs in the functions nmbs_read_device_identification_basic() and recv_read_device_identification_res() within nanomodbus.c. The vulnerability arises because a fixed 3-element stack array is used to map object IDs to buffer indices, but the object_id field, which is read directly from the wire, is applied without proper bounds checking. When a malicious Modbus server sends a Read Device Identification response with an object_id of 3 or higher, it can read an out-of-bounds or garbage byte from the stack. This byte, which is adjacent to the order array, is then used as an index for a 3-element array of char* pointers. The resulting wild pointer is passed to strncpy() as the destination, enabling an arbitrary-address write with server-controlled data.