Off-by-One Buffer Overflow in nanoMODBUS by debevv

CVE-2026-54410

What is CVE-2026-54410?

The nanoMODBUS product, specifically version 1.23.0, contains an off-by-one buffer overflow in the recv_msg_header() function. This vulnerability allows remote, unauthenticated attackers to manipulate the Modbus/TCP server by sending a specially crafted MBAP frame. The exploit is made possible by setting the Length field to 255, which writes beyond the end of the 260-byte receive buffer. This leads to corruption of the adjacent buffer-index field within the nanoMODBUS state structure, potentially causing denial of service due to invalid memory accesses. Additionally, in systems without memory protection, it could result in information disclosure and writes to incorrect register addresses in the Write Multiple Registers (FC16) handler.

References