Description
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.
Published: 2026-08-05
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

nanoMODBUS up to version 1.23.0 contains an out‑of‑bounds write in the server‑side handle_read_file_record() function for Modbus function code 0x14. The code checks each sub‑request’s record length but never checks the cumulative response size before allocating and writing data. The result is a buffer overflow that can corrupt adjacent memory and potentially cause the server to crash or, in the worst case, allow arbitrary code execution. This is a classic out‑of‑bounds write (CWE‑787) that affects the integrity and availability of the application.

Affected Systems

The flaw affects the nanoMODBUS server developed by debevv. All releases up to and including version 1.23.0 are vulnerable. No other vendors or product variants appear to be impacted according to the advisory.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% reflects a low but non‑zero probability of exploitation in the wild. The description does not specify authentication requirements, so it is unclear whether only authenticated clients can trigger the vulnerability. Based on typical Modbus deployments, the likely attack vector is an unauthenticated network client that can send a crafted FC 0x14 request. The vulnerability is not yet listed in the CISA KEV catalog, which suggests it has not been widely exploited, but the combination of a high severity score and the ease of constructing the faulting request means the risk remains significant for exposed deployments.

Generated by OpenCVE AI on August 10, 2026 at 22:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade nanoMODBUS to any version newer than 1.23.0 which contains the out‑of‑bounds write fix.
  • Configure network controls such as firewalls or VPNs to limit which hosts can reach the Modbus server and can issue function code 0x14 messages.
  • If the Read File Record functionality is not required, disable or remove it from the server configuration; otherwise, apply a temporary patch or modify the code to validate the cumulative response size before processing sub‑requests.

Generated by OpenCVE AI on August 10, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record() function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them. The accumulator response_data_size is declared as uint8_t and is incremented by 2 + record_length*2 for each of up to 35 sub-requests; with 35 sub-requests of record_length=124, the cumulative demand is 8750 bytes, which overflows the uint8_t accumulator. A subsequent loop then calls get_n(), an internal function with no bounds checking, once per sub-request to obtain a pointer into the 260-byte msg.buf receive buffer and advances the internal buf_idx by up to 248 bytes per call; swap_regs() then writes to that pointer unconditionally. A single crafted FC 0x14 request from an unauthenticated network client can cause up to ~8490 bytes to be written out of bounds past the 260-byte buffer, corrupting adjacent memory in the server process and leading to denial of service or potential remote code execution, particularly on embedded/bare-metal targets without memory protection. nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.
Title nanoMODBUS - Server-Side Out-of-Bounds Write in handle_read_file_record() nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record() nanoMODBUS - Server-Side Out-of-Bounds Write in handle_read_file_record()

Wed, 05 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Debevv
Debevv nanomodbus
Vendors & Products Debevv
Debevv nanomodbus

Wed, 05 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 05 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record() function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them. The accumulator response_data_size is declared as uint8_t and is incremented by 2 + record_length*2 for each of up to 35 sub-requests; with 35 sub-requests of record_length=124, the cumulative demand is 8750 bytes, which overflows the uint8_t accumulator. A subsequent loop then calls get_n(), an internal function with no bounds checking, once per sub-request to obtain a pointer into the 260-byte msg.buf receive buffer and advances the internal buf_idx by up to 248 bytes per call; swap_regs() then writes to that pointer unconditionally. A single crafted FC 0x14 request from an unauthenticated network client can cause up to ~8490 bytes to be written out of bounds past the 260-byte buffer, corrupting adjacent memory in the server process and leading to denial of service or potential remote code execution, particularly on embedded/bare-metal targets without memory protection.
Title nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Debevv Nanomodbus
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:46:13.975Z

Reserved: 2026-08-05T11:43:52.777Z

Link: CVE-2026-71254

cve-icon Vulnrichment

Updated: 2026-08-05T12:29:55.464Z

cve-icon NVD

Status : Deferred

Published: 2026-08-05T12:18:57.600

Modified: 2026-08-26T17:13:24.800

Link: CVE-2026-71254

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T23:00:07Z

Weaknesses