The vulnerability is an off‑by‑one buffer overflow in the recv_msg_header() function of the Modbus/TCP server in nanoMODBUS. A remote, unauthenticated attacker can send a crafted MBAP frame whose Length field is set to 255, overwriting one byte past the 260‑byte receive buffer. This corrupts the adjacent buffer‑index field in the nanoMODBUS state structure, triggering invalid memory accesses that lead to a denial of service. On bare‑metal and RTOS targets that lack memory protection, the overflow can also expose one byte of adjacent memory and allow writes to unintended register addresses during the Write Multiple Registers (FC16) handler call.

The issue affects the debevv nanoMODBUS implementation, specifically versions up to and including 1.23.0. The vulnerability originates in the Modbus/TCP server code and thus impacts any deployment of this version that exposes the Modbus/TCP service to network traffic.

The CVSS score of 7.8 indicates a high severity, but the EPSS score is currently not available, suggesting no confirmed exploitation data. The vulnerability is not listed in CISA’s KEV catalog. An attacker requires network access to the Modbus/TCP port and does not need authentication; the attack vector is remote over the network. Successful exploitation can cause service interruption and, in environments without memory protection, may reveal memory contents or alter device registers.