{"id":"CVE-2026-71254","published":"2026-08-05T12:18:57.600","lastModified":"2026-08-10T12:17:27.960","description":"nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/debevv/nanoMODBUS","tags":[]},{"url":"https://github.com/debevv/nanoMODBUS/blob/master/nanomodbus.c","tags":[]}],"exploitRefs":[{"url":"https://github.com/debevv/nanoMODBUS","tags":[]},{"url":"https://github.com/debevv/nanoMODBUS/blob/master/nanomodbus.c","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to perform an out-of-bounds write, leading to potential data corruption or system instability. This is critical because it can be exploited without user interaction and affects the Modbus server-side handle_read_file_record function.","exploitability":"Exploitation is relatively straightforward as no user interaction is required, and the attacker can send crafted Modbus requests to trigger the out-of-bounds write.","blast_radius":"If exploited, the impact could be severe, potentially leading to data corruption, system crashes, or other critical failures in the affected system.","remediation":"Upgrade to nanoMODBUS v1.23.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["modbus","out-of-bounds","ics"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T09:00:26.800Z"}}