CVE-2026-54410: nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field
nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recvmsgheader() function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow corrupts the adjacent buffer-index field of the nanoMODBUS state structure, resulting in denial of service through invalid memory accesses and, on bare-metal and RTOS targets without memory protection, one-byte information disclosure and writes to unintended register addresses on the Write Multiple Registers (FC16) handler path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
nanoMODBUSfrom your environment.Uninstall nanoMODBUS from systems where Modbus/TCP functionality is not required.
- Configuration
Disable the Modbus/TCP server if it is not required to eliminate exposure to crafted MBAP frames that can trigger the off-by-one overflow.
nanoMODBUS Modbus/TCP server enabled = false - Configuration
Disable the FC16 (Write Multiple Registers) handler if not required to prevent unintended register writes triggered by the overflow.
nanoMODBUS Write Multiple Registers (FC16) handler enabled = false - Compensating control
Restrict network access to the Modbus/TCP interface to trusted hosts only using firewall rules, ACLs, or network segmentation to prevent remote unauthenticated attackers from sending crafted MBAP frames.
- Compensating control
Isolate or place additional network controls around bare-metal and RTOS targets without memory protection to limit exposure, as these targets are at higher risk of information disclosure and unintended writes.
- Operational
Monitor devices for crashes, signs of denial-of-service, and unexpected register writes; take affected devices offline for analysis and recovery if exploitation is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54410?
The severity of CVE-2026-54410 is rated high with a score of 8.6.
What type of vulnerability is CVE-2026-54410?
CVE-2026-54410 is a buffer overflow vulnerability due to an off-by-one error.
How can I mitigate CVE-2026-54410?
Mitigation of CVE-2026-54410 includes updating nanoMODBUS to a version beyond 1.23.0.
Is remote authentication required to exploit CVE-2026-54410?
No, CVE-2026-54410 can be exploited by remote unauthenticated attackers.
What is the impact of a successful exploit of CVE-2026-54410?
A successful exploit of CVE-2026-54410 allows attackers to write one controlled byte past the end of the receive buffer, potentially leading to arbitrary code execution.