The vuln is an out‑of‑bounds write in the nanoMODBUS client routine that processes Read Device Identification responses. A server can supply an object_length value that is not checked against the caller‑supplied buffer length; this allows the function to write past the end of its local buffer, corrupting adjacent memory. Such corruption can compromise data integrity, lead to undefined behavior, and potentially crash the client.

The issue affects the nanoMODBUS library from debevv. All releases up to v1.23.0 include the flaw. Users must verify the installed package version and seek an updated release from the vendor.

The CVSS score of 8.6 indicates a high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves a malicious or compromised Modbus server that responds with a crafted packet containing an overly large object_length field. The client must only accept responses from trusted servers or enforce additional validation to reduce risk.