The vulnerability is an off‑by‑one buffer overflow in the recv_msg_header() function of the Modbus/TCP server in nanoMODBUS. A remote unauthenticated attacker can send a crafted MBAP frame whose Length field is set to 255, causing a single attacker‑controlled byte to be written just past the 260‑byte receive buffer. This off‑by‑one error can corrupt adjacent memory structures, potentially leading to service disruption or other unexpected behavior, though higher‑level exploitation is not documented in the description. The flaw corresponds to classic buffer overrun weaknesses (CWE-193, CWE-787).

The issue affects the debevv nanoMODBUS implementation, specifically versions up to and including 1.23.0. It originates in the Modbus/TCP server code, so any deployment that exposes this service to network traffic is impacted.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker requires only network access to the Modbus/TCP port and does not need authentication. The attack vector is remote over the network. Successful exploitation can lead to loss of service due to memory corruption or potentially alter device behavior if critical memory areas are affected.