CVE-2026-54410

Vulnerability

nanoMODBUS through version v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server [3]. The receive buffer is 260 bytes, but when parsing a malicious MBAP frame with a Length field set to 255, the server writes one attacker-controlled byte past the end of the buffer [4]. This corrupts the adjacent buffer-index field of the nanoMODBUS state structure [4]. The vulnerability is classified as CWE-787 Out-of-bounds Write [1] and CWE-193 Off-by-one Error [2]. Affected versions: all releases before the fix [3].

Exploitation

An unauthenticated remote attacker can trigger the vulnerability by sending a crafted TCP packet containing a Modbus MBAP header with the Length field set to 255 [4]. No prior authentication or special network position is required beyond reachability of the Modbus/TCP port [3]. The overflow occurs during header parsing in recv_msg_header() before any function-code-specific processing [4]. The attacker controls the single overwritten byte through the MBAP frame content [4].

Impact

Successful exploitation corrupts the buffer-index field, leading to invalid memory accesses that can cause the server process to crash, resulting in denial of service [4]. On bare-metal and RTOS targets without memory protection, the attacker may additionally achieve one-byte information disclosure and, via the Write Multiple Registers (FC16) handler path, write an unintended value to a register address derived from the corrupted index [4]. The impact is limited to a single overwritten byte, but it can compromise system stability and, on unprotected systems, lead to limited data leaks and register corruption [4].

Mitigation

No fixed version has been released as of the publication date. Users should monitor the nanoMODBUS repository [3] for patches. As a workaround, restrict network access to the Modbus/TCP port to trusted hosts only, or implement a firewall to filter incoming Modbus traffic until an update is available [4]. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog [not in references].