The vulnerability in nanoMODBUS (up to version 1.22.0) is a stack-based buffer overflow in the recv_read_registers_res() function within nanomodbus.c. When a client invokes nmbs_read_holding_registers() or nmbs_read_input_registers(), the library trusts the byte_count field from the server response to determine how much data to write into the caller's buffer. Because the byte_count is not validated against the originally requested quantity, a malicious Modbus TCP server can send a response with a byte_count of 250 (125 registers), causing the library to write up to 248 bytes beyond the buffer boundary. This memory corruption can potentially lead to remote code execution on the client side.

A remote attacker controlling a Modbus TCP server can exploit this vulnerability to cause a stack-based buffer overflow on a client using nanoMODBUS. This may lead to remote code execution, allowing the attacker to execute arbitrary code on the affected client system. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should avoid connecting to untrusted or potentially malicious Modbus TCP servers. Implementing network-level controls to restrict access to trusted servers may reduce exposure.