CVE-2026-11826: Heap-based Buffer Overflow in openplcproject OpenPLC_v3
OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4.
AI Analysis
Technical Summary
CVE-2026-11826 is a heap-based buffer overflow in OpenPLC_v3's getData() function located in webserver/core/modbus_master.cpp. The function reads characters between delimiters into a caller-supplied buffer without size or bounds checks. In parseConfig(), getData() is called with a 100-byte heap-allocated buffer for MB_device.dev_name. An authenticated attacker can send an oversized device_name in an HTTP POST to /modbus, which is persisted and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol, dev_address, ip_port). A 200-byte payload writes 100 bytes beyond the allocation, causing heap corruption and crashing the PLC control loop. The upstream repository was archived on 2026-04-04 with no fix planned. The vendor confirmed OpenPLC Runtime v4 is not affected.
Potential Impact
Exploitation results in heap corruption leading to a runtime crash and denial of service of the PLC process control loop. Additionally, attacker-controlled overwrites of adjacent configuration fields can alter device behavior. The vulnerability requires authentication and network access to the OpenPLC web interface. No known exploits are reported in the wild. The vulnerability affects only OpenPLC_v3; OpenPLC Runtime v4 is not impacted.
Mitigation Recommendations
No official fix or patch is available as the upstream repository was archived and no fix is expected. Users should consider upgrading to OpenPLC Runtime v4, which is confirmed not to be affected by this vulnerability. Restricting access to the OpenPLC_v3 web interface to trusted users and networks may reduce risk. Monitor for any vendor updates or community patches, but currently, no remediation is provided.
CVE-2026-11826: Heap-based Buffer Overflow in openplcproject OpenPLC_v3
Description
OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4.
CVSS v4.0
Score 8.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11826 is a heap-based buffer overflow in OpenPLC_v3's getData() function located in webserver/core/modbus_master.cpp. The function reads characters between delimiters into a caller-supplied buffer without size or bounds checks. In parseConfig(), getData() is called with a 100-byte heap-allocated buffer for MB_device.dev_name. An authenticated attacker can send an oversized device_name in an HTTP POST to /modbus, which is persisted and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol, dev_address, ip_port). A 200-byte payload writes 100 bytes beyond the allocation, causing heap corruption and crashing the PLC control loop. The upstream repository was archived on 2026-04-04 with no fix planned. The vendor confirmed OpenPLC Runtime v4 is not affected.
Potential Impact
Exploitation results in heap corruption leading to a runtime crash and denial of service of the PLC process control loop. Additionally, attacker-controlled overwrites of adjacent configuration fields can alter device behavior. The vulnerability requires authentication and network access to the OpenPLC web interface. No known exploits are reported in the wild. The vulnerability affects only OpenPLC_v3; OpenPLC Runtime v4 is not impacted.
Mitigation Recommendations
No official fix or patch is available as the upstream repository was archived and no fix is expected. Users should consider upgrading to OpenPLC Runtime v4, which is confirmed not to be affected by this vulnerability. Restricting access to the OpenPLC_v3 web interface to trusted users and networks may reduce risk. Monitor for any vendor updates or community patches, but currently, no remediation is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-09T19:53:45.722Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5b8a8244ab8fbf7c59606e
Added to database: 07/18/2026, 14:15:30 UTC
Last enriched: 08/02/2026, 20:58:49 UTC
Last updated: 08/31/2026, 22:52:08 UTC
Views: 172
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.