What’s Vulnerable › Vulnerabilities
CVE-2026-71255: nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-05 · updated 2026-10-24
- Weakness: CWE-787
Description
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
Affected products
- debevv nanoMODBUS: through 1.23.0
References
Get alerted when CVE-2026-71255 or the next vulnerability affects your stack