CVE-2026-54410 is an off-by-one buffer overflow in the recv_msg_header() function of the nanoMODBUS Modbus/TCP server up to version 1.23.0. The vulnerability arises when processing an MBAP frame with a Length field set to 255, allowing an attacker to overwrite one byte past the 260-byte receive buffer. This corrupts the adjacent buffer-index field in the nanoMODBUS state structure, resulting in denial of service through invalid memory accesses. On systems lacking memory protection, such as bare-metal or RTOS targets, this overflow can also cause one-byte information disclosure and unintended writes to register addresses in the Write Multiple Registers (FC16) handler path. The vulnerability is remotely exploitable without authentication.

The vulnerability enables remote unauthenticated attackers to cause denial of service by corrupting memory structures, leading to invalid memory accesses. On bare-metal and RTOS systems without memory protection, it may also result in limited information disclosure and unauthorized writes to Modbus registers, potentially affecting system integrity and reliability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing network-level protections to restrict access to the Modbus/TCP server and monitor for anomalous MBAP frames with suspicious Length field values. Avoid exposing the vulnerable service to untrusted networks.