These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-71256 vulnerability in nanoMODBUS through v1.23.0 involves an out-of-bounds stack read leading to a wild-pointer write. This occurs in the nmbs_read_device_identification_basic() and recv_read_device_identification_res() functions within nanomodbus.c. The issue arises from a fixed 3-element stack array 'order' that maps object IDs to buffer indices. The server-supplied object_id field, read d [truncated]
The CVE-2026-71255 vulnerability in nanoMODBUS through v1.23.0 is an out-of-bounds write in the Modbus client-side recv_read_device_identification_res() function. This occurs because the server-supplied object_length field is not validated against the caller-supplied buffers_length parameter, potentially leading to memory corruption on the client. Organizations should be aware of the vulnerability and tak [truncated]
A critical vulnerability exists in nanoMODBUS through v1.23.0, allowing for out-of-bounds writes due to improper validation of cumulative response sizes in the Modbus server-side handle_read_file_record() function. This function processes Modbus server-side requests (FC 0x14, Read File Record) and fails to ensure that the cumulative response size does not exceed the buffer limits, leading to potential den [truncated]
CVE-2026-54410 is a HIGH severity vulnerability in nanoMODBUS through v1.23.0. The vulnerability is caused by an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server. This allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow co [truncated]