EUVD-2026-40152
GHSA-r3g9-96ff-r4rp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Modbus parser requires no auth or interaction (PR:N/UI:N), but AC:H reflects the heap manipulation complexity; no scope change and only limited C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.
AnalysisAI
Heap-based buffer overflow in PcapPlusPlus 25.05 allows remote, unauthenticated attackers to corrupt heap memory by sending a crafted Modbus TCP packet containing a malformed length field to applications using the library's pcpp::ModbusLayer::getLength() parser. The CVSS 4.0 score of 2.9 reflects the high attack complexity (AC:H) required to exploit the flaw reliably, with impact capped at low across confidentiality, integrity, and availability. Publicly available exploit code exists (poc.zip), though no active exploitation has been confirmed by CISA KEV at time of analysis.
Technical ContextAI
PcapPlusPlus is an open-source, multi-platform C++ library for network packet capture and parsing built atop libpcap and WinPcap/Npcap. The affected function, pcpp::ModbusLayer::getLength(), resides in Packet++/header/ModbusLayer.h and is responsible for extracting the length field from Modbus Application Data Unit (MBAP) headers. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) identifies the root cause: the function does not adequately validate the attacker-supplied length value against the actual packet buffer boundaries before using it in a heap memory operation, permitting an out-of-bounds write on the heap. Modbus is a serial communication protocol widely deployed over TCP (port 502) in industrial control systems (ICS) and SCADA environments. Any application that ingests untrusted Modbus traffic and relies on PcapPlusPlus for packet dissection is potentially within the attack surface. No CPE string was provided in the input data; the affected library is tracked at https://github.com/seladb/PcapPlusPlus.
RemediationAI
The upstream fix is available as commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454 on the PcapPlusPlus GitHub repository, merged via PR #2159 (https://github.com/seladb/PcapPlusPlus/pull/2159). This is an upstream fix at the commit and pull-request level; a formally released patched version is not independently confirmed from the available data - developers must verify which tagged release incorporates this commit before deploying. Teams building against PcapPlusPlus should pin to a commit at or after 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454 until an official release is tagged. As a compensating control, applications can add a pre-parse length validation step that checks the Modbus length field against the remaining buffer size before passing packets to ModbusLayer::getLength() - this reduces the attack surface with no functional trade-off. Additionally, restricting Modbus traffic ingestion to trusted, authenticated network segments (e.g., via firewall rules limiting TCP port 502 access) will eliminate the remote attack vector entirely for environments that control their network perimeter, though this may not be feasible in passive capture deployments.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today