CVE-2026-71254 is an out-of-bounds write vulnerability (CWE-787) in the nanoMODBUS library up to version 1.23.0. The issue exists in the Modbus server-side handle_read_file_record function (function code 0x14, Read File Record) implemented in nanomodbus.c. While the function validates that the total request size does not exceed 245 bytes and each sub-request's record_length is at most 124 bytes, it fails to validate the cumulative response size across all sub-requests before processing. This can lead to an out-of-bounds write condition, potentially allowing an attacker to corrupt memory and cause denial of service or execute arbitrary code.

Successful exploitation of this vulnerability can result in a critical impact affecting confidentiality, integrity, and availability of the affected system. An attacker can cause memory corruption through out-of-bounds writes, which may lead to denial of service or arbitrary code execution within the context of the nanoMODBUS server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor the vendor's communications for updates and apply patches once available.