An out-of-bounds stack read in nanoMODBUS allows a malicious Modbus server to supply an object_id value beyond the 0‑2 range of the three-element stack array order[3] = {0,1,2}. The server-supplied object_id (0‑255) is used without bounds checking as buf_index = order[object_id], which indirection can produce a wild pointer during the read. The resulting writing of data to that address may corrupt memory, potentially enabling arbitrary code execution on the client.

Debevv nanoMODBUS clients with version 1.23.0 or earlier are affected; all instances remain at risk until a vendor update is applied.

The CVSS score of 9.8 indicates a high severity vulnerability. The EPSS score of < 1% suggests a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote Modbus server capable of sending a crafted Read Device Identification response; the client must be reachable over Modbus, and the attacker needs to supply an object_id of at least 3 to trigger the out‑of‑bounds access, making the flaw remotely exploitable.