OpenPLC_v3 Heap-Based Buffer Overflow (CVE-2026-11826)

CVE-2026-11826 details a critical heap-based buffer overflow vulnerability affecting OpenPLC_v3, specifically within the getData() function located in webserver/core/modbus_master.cpp. This function is responsible for reading characters between delimiters but lacks bounds checking, making it susceptible to overflow when invoked with an oversized input. An authenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /modbus endpoint through the OpenPLC web interface. The vulnerability occurs when an unusually long device_name value (exceeding the allocated 100-byte buffer for MB_device.dev_name) is persisted to mbconfig.cfg and subsequently parsed. This leads to heap corruption, overwriting adjacent configuration fields such as protocol, dev_address, and ip_port, ultimately causing a runtime crash and denial of service for the PLC process control loop. As the upstream repository for OpenPLC_v3 was archived on April 4, 2026, no official fix is anticipated, though OpenPLC Runtime v4 is confirmed to be unaffected.

Attack Chain

1. An authenticated attacker gains access to the OpenPLC_v3 web interface, typically through legitimate credentials or compromised accounts.
2. The attacker crafts a malicious HTTP POST request targeting the /modbus endpoint of the OpenPLC web server.
3. The crafted request includes an device_name parameter with a value significantly larger than 100 bytes, which exceeds the buffer size.
4. The OpenPLC web server receives the request, and its parseConfig() function processes the configuration data, including the oversized device_name.
5. During configuration parsing, the getData() function is called to read the device_name into a 100-byte heap-allocated buffer (MB_device.dev_name).
6. Due to the lack of bounds checking in getData(), the oversized device_name value overflows the buffer, causing heap corruption.
7. The heap corruption overwrites adjacent critical struct fields, including protocol (at offset 108), dev_address (at offset 109), and ip_port (at offset 210).
8. The integrity of the OpenPLC process is compromised, leading to a runtime crash and denial of service, effectively halting the PLC's process control loop.

Impact

Successful exploitation of CVE-2026-11826 results in a critical denial of service (DoS) for affected OpenPLC_v3 systems. The heap corruption directly causes a runtime crash of the PLC process, leading to an immediate cessation of its control functions. This can have severe consequences in industrial control system (ICS) environments, potentially disrupting critical operations, causing production outages, or leading to unsafe conditions depending on the PLC's role. Additionally, the attacker-controlled overwrite of adjacent configuration fields introduces the risk of further system compromise or manipulation, although direct remote code execution is not explicitly detailed. As OpenPLC_v3 is no longer maintained, affected organizations face ongoing risk without a vendor-provided patch.

Recommendation

• If possible, upgrade from OpenPLC_v3 to OpenPLC Runtime v4 to remediate CVE-2026-11826, as the vulnerability does not affect the newer version.
• Deploy the provided Sigma rule to your SIEM to detect exploitation attempts of CVE-2026-11826 via suspicious HTTP POST requests to the /modbus endpoint.
• Ensure web server logs capture full HTTP request details, including cs-method, cs-uri-stem, and cs-uri-query, to activate the detection rule.
• Implement strong authentication policies and regularly audit accounts with access to the OpenPLC web interface (referencing the "authenticated attacker" detail in the Overview).