CVE-2026-71254 affects nanoMODBUS through v1.23.0, a lightweight Modbus protocol library. The vulnerability is an out-of-bounds write in the server-side handle_read_file_record() function (FC 0x14) within nanomodbus.c. The flaw stems from a failure to validate cumulative response size across sub-requests, combined with a uint8_t integer overflow in the response_data_size accumulator. With 35 sub-requests of maximum record_length, up to 8750 bytes of data demand can overflow the 260-byte msg.buf buffer. The internal get_n() function performs no bounds checking, and swap_regs() writes unconditionally to the resulting pointer. An unauthenticated remote attacker can send a single crafted FC 0x14 request to cause approximately 8490 bytes of out-of-bounds writes, corrupting adjacent memory. Impact ranges from denial of service to potential remote code execution, with heightened risk on embedded and bare-metal targets lacking memory protection.