CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()
A malicious Modbus server can trigger an out-of-bounds write in nanoMODBUS clients, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71255?
CVE-2026-71255 is a high-severity memory corruption vulnerability in debevv nanoMODBUS, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.
Weakness: CWE-787
Which versions are affected by CVE-2026-71255?
How do I fix CVE-2026-71255?
No fix has been published for CVE-2026-71255 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-71255 being exploited?
There is no known exploitation of CVE-2026-71255 in the wild and no public exploit code.
Sources
Also known as GHSA-9rfp-q4v5-653h.