CVE-2026-71255 is an out-of-bounds write vulnerability in the nanoMODBUS library through version 1.23.0. The flaw exists in the Modbus client-side function recv_read_device_identification_res, which processes the Read Device Identification response (function code 0x2B, MEI type 0x0E). The vulnerability arises because the server-supplied object_length field, which can range from 0 to 246, is only validated against the remaining PDU size (res_size_left) but not against the caller-supplied buffers_length parameter. This lack of proper validation can lead to writing beyond the bounds of the buffer, causing memory corruption.

Successful exploitation of this vulnerability can lead to memory corruption, which may result in denial of service or potentially allow an attacker to execute arbitrary code. The CVSS score of 8.6 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing untrusted Modbus responses and consider additional input validation or sandboxing measures to mitigate potential exploitation.