CVE-2026-11826: Heap-based Buffer Overflow in openplcproject OpenPLC_v3
OpenPLC_v3 contains a heap-based buffer overflow vulnerability in the getData() function within the webserver core modbus_master.cpp. An authenticated attacker can exploit this by sending a crafted HTTP POST request to the /modbus endpoint with an oversized device_name value, causing heap corruption and denial of service by crashing the PLC process control loop. The vulnerability allows overwriting adjacent configuration fields, potentially impacting device operation. The upstream project was archived in April 2026, and no fix is expected for OpenPLC_v3. The vendor confirmed this issue does not affect OpenPLC Runtime v4.
AI Analysis
Technical Summary
CVE-2026-11826 is a heap-based buffer overflow in OpenPLC_v3's getData() function, which reads characters into a caller-supplied buffer without bounds checking. The vulnerable buffer is a 100-byte heap-allocated field dev_name. An authenticated attacker can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value, which is persisted and parsed on load, overflowing dev_name and overwriting adjacent struct fields such as protocol, dev_address, and ip_port. This overflow leads to heap corruption and a runtime crash causing denial of service of the PLC control loop. The upstream repository was archived on 2026-04-04 with no fix expected. The vendor confirmed OpenPLC Runtime v4 is not affected.
Potential Impact
Successful exploitation results in heap corruption and a runtime crash of the PLC process control loop, causing denial of service. Additionally, attacker-controlled overwrites of adjacent configuration fields may affect device behavior. The vulnerability requires authenticated access to the web interface. There are no known exploits in the wild. No fix is available for OpenPLC_v3 as the project is archived, but OpenPLC Runtime v4 is unaffected.
Mitigation Recommendations
No official fix or patch is available for OpenPLC_v3 because the upstream project has been archived and no remediation is planned. Users should consider upgrading to OpenPLC Runtime v4, which the vendor confirms is not affected by this vulnerability. Until migration, restrict authenticated access to the OpenPLC_v3 web interface to trusted users only to reduce risk.
CVE-2026-11826: Heap-based Buffer Overflow in openplcproject OpenPLC_v3
Description
OpenPLC_v3 contains a heap-based buffer overflow vulnerability in the getData() function within the webserver core modbus_master.cpp. An authenticated attacker can exploit this by sending a crafted HTTP POST request to the /modbus endpoint with an oversized device_name value, causing heap corruption and denial of service by crashing the PLC process control loop. The vulnerability allows overwriting adjacent configuration fields, potentially impacting device operation. The upstream project was archived in April 2026, and no fix is expected for OpenPLC_v3. The vendor confirmed this issue does not affect OpenPLC Runtime v4.
CVSS v4.0
Score 8.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11826 is a heap-based buffer overflow in OpenPLC_v3's getData() function, which reads characters into a caller-supplied buffer without bounds checking. The vulnerable buffer is a 100-byte heap-allocated field dev_name. An authenticated attacker can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value, which is persisted and parsed on load, overflowing dev_name and overwriting adjacent struct fields such as protocol, dev_address, and ip_port. This overflow leads to heap corruption and a runtime crash causing denial of service of the PLC control loop. The upstream repository was archived on 2026-04-04 with no fix expected. The vendor confirmed OpenPLC Runtime v4 is not affected.
Potential Impact
Successful exploitation results in heap corruption and a runtime crash of the PLC process control loop, causing denial of service. Additionally, attacker-controlled overwrites of adjacent configuration fields may affect device behavior. The vulnerability requires authenticated access to the web interface. There are no known exploits in the wild. No fix is available for OpenPLC_v3 as the project is archived, but OpenPLC Runtime v4 is unaffected.
Mitigation Recommendations
No official fix or patch is available for OpenPLC_v3 because the upstream project has been archived and no remediation is planned. Users should consider upgrading to OpenPLC Runtime v4, which the vendor confirms is not affected by this vulnerability. Until migration, restrict authenticated access to the OpenPLC_v3 web interface to trusted users only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-09T19:53:45.722Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5b8a8244ab8fbf7c59606e
Added to database: 07/18/2026, 14:15:30 UTC
Last enriched: 07/18/2026, 14:29:50 UTC
Last updated: 07/18/2026, 15:11:26 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.