CVE-2024-10918 describes a stack-based buffer overflow in libmodbus v3.1.10. The flaw arises when the function handling Modbus responses attempts to reply to a request with an unexpected length, causing the buffer allocated for the response to overflow. This vulnerability is categorized under CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and impacts integrity and availability with low and low impact respectively. There is no information about available patches or fixes.

Exploitation of this vulnerability could lead to integrity and availability impacts due to the buffer overflow condition. Specifically, an attacker could cause a crash or potentially execute arbitrary code by sending a specially crafted Modbus request with an unexpected length. However, the attack complexity is high and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected libmodbus service and monitor for anomalous Modbus traffic with unexpected lengths. Avoid processing untrusted Modbus requests if possible.