🚨High - OpenPLC_v3 Heap Overflow in Modbus Master getData() (CVE-2026-11826) OpenPLC_v3's getData() in modbus_master.cpp copies data between two delimiters into a fixed 100-byte heap buffer (MB_device.dev_name) with no bounds check. An authenticated attacker can POST an oversized device_name to the /modbus endpoint; it's saved to mbconfig.cfg and parsed on load, overflowing the buffer and overwriting adjacent struct fields (protocol, dev_address, ip_port). A 200-byte payload writes 100 bytes past the allocation, corrupting the heap and crashing the PLC control loop - a denial of service with real safety implications in OT, plus attacker-controlled overwrite of adjacent config. CVSS 8.7. Note: the OpenPLC_v3 repo was archived on 2026-04-04 and no fix is expected. OpenPLC Runtime v4 is not affected. 👉Migrate from OpenPLC_v3 to OpenPLC Runtime v4 and restrict access to the web interface.
Post summary
CVE-2026-11826 is a high‑severity heap overflow in OpenPLC v3 that can cause denial of service and config tampering; no patch is available, so users should migrate to the unaffected OpenPLC Runtime v4 and secure the web interface.
