Loading vulnerability…
CVE-2026-11826 is a heap-based buffer overflow in OpenPLC_v3 affecting versions through git commit b470206. The flaw is in the getData() function in webserver/core/modbus_master.cpp, which copies characters between delimiters into a caller-supplied buffer without accepting a size parameter and without performing bounds checks. In parseConfig(), this function is called with the 100-byte heap-allocated MB_device.dev_name field as the destination buffer. An authenticated attacker with access to the OpenPLC web interface can submit a crafted POST request to the Modbus configuration endpoint containing an oversized device_name value. That value is persisted to configuration and later parsed, causing an overflow of the dev_name allocation and corruption of adjacent heap-resident structure fields, including protocol, dev_address, and ip_port. A sufficiently large payload can write well past the intended allocation, resulting in heap corruption and instability in the PLC runtime.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.