nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_id…

CVE-2026-71256 affects nanoMODBUS through v1.23.0, a lightweight Modbus protocol library. The vulnerability exists in the nmbs_read_device_identification_basic() and recv_read_device_identification_res() functions in nanomodbus.c. A fixed 3-element stack array order[3] is used to map object IDs to buffer indices without any bounds checking. A malicious Modbus server can send a Read Device Identification response with an object_id value of 3 or greater (valid range 0-255), causing an out-of-bounds read from the stack. The garbage byte read from the stack is then used as an index into a char* pointer array, resulting in a wild pointer. This wild pointer is passed to strncpy() as the destination, enabling an arbitrary-address write with server-controlled data. The impact is critical as it allows a compromised or malicious Modbus server to achieve arbitrary memory writes on connecting clients, potentially leading to remote code execution in industrial control system environments.