CVE-2026-13590: Heap-Based Buffer Overflow in PcapPlusPlus 25.05 Modbus Handler

Technical summary

CVE-2026-13590 is a heap-based buffer overflow in PcapPlusPlus 25.05's Modbus Protocol Handler, located in the pcpp::ModbusLayer::getLength function within Packet++/header/ModbusLayer.h. The flaw occurs when the length parameter is manipulated during Modbus packet processing, causing writes beyond allocated heap boundaries. The vulnerability maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow). Exploitation requires crafting a malicious Modbus packet and delivering it to a system running the affected library; however, the attack complexity is rated as high, meaning specific conditions must align for successful exploitation. A public exploit has been released, increasing practical risk.

Business impact

Organizations using PcapPlusPlus 25.05 for packet analysis, network monitoring, or Modbus protocol inspection face potential exposure. Successful exploitation could result in information disclosure (leaking credentials, keys, or application data from memory), data integrity issues (corrupting packet analysis results or logs), or denial of service (crashing monitoring tools). For critical infrastructure or industrial control environments relying on Modbus protocol processing, this vulnerability could disrupt network visibility and incident response capabilities. The moderate CVSS score (5.6) reflects that while impact is feasible, the barrier to exploitation remains substantial.

Affected systems

PcapPlusPlus version 25.05 is affected. Any application or tool embedding this library and processing untrusted Modbus traffic is potentially vulnerable, including packet capture utilities, network monitoring platforms, and industrial protocol analyzers. Systems in air-gapped or closed networks face lower risk, while those analyzing external or Internet-facing Modbus devices are at higher risk.

Exploitability

Although a public exploit has been released, actual exploitation requires high technical complexity. An attacker must craft a Modbus packet with a precise length manipulation, deliver it to a vulnerable system, and successfully trigger memory corruption. Factors limiting real-world exploitation include the need for Modbus traffic to reach the vulnerable function, the precise nature of the buffer overflow, and environment-specific memory layout variations. Nevertheless, the availability of public exploit code lowers the barrier for motivated threat actors and means this is no longer a theoretical risk.

Remediation

Apply the security patch identified as commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454 to PcapPlusPlus. Verify the exact patched version number against the seladb project's official releases and security advisories before deployment. Until patching is possible, implement network segmentation to restrict untrusted Modbus traffic from reaching systems running PcapPlusPlus 25.05, or disable Modbus protocol processing if not actively required.

Patch guidance

Obtain the patched version from the official seladb PcapPlusPlus repository, confirming it includes commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Test the patch in a non-production environment to ensure compatibility with dependent applications before rolling out to production systems. Verify patch application by reviewing release notes and commit history rather than relying solely on version numbers. If using PcapPlusPlus as a library dependency, update your project's build configuration and re-link all dependent binaries.

Detection guidance

Monitor for suspicious Modbus packets with malformed or oversized length fields arriving at systems running PcapPlusPlus. Log and alert on crashes or segmentation faults in applications using the library, particularly if correlating with network traffic analysis tools. Endpoint Detection and Response (EDR) solutions should flag unexpected memory corruption or process crashes in packet processing contexts. Review network logs for anomalous Modbus traffic patterns, particularly from untrusted sources. Perform software inventory scans to identify systems running PcapPlusPlus 25.05 and prioritize patching.

Why prioritize this

This vulnerability warrants prompt but measured attention. The public availability of exploit code significantly elevates practical risk, and the MEDIUM severity reflects real potential for data breach or service disruption. However, the high attack complexity means opportunistic or script-kiddie exploitation is unlikely. Prioritize patching systems analyzing untrusted or externally-sourced Modbus traffic and those in industrial or critical infrastructure environments. Lower priority for closed networks or air-gapped systems with no Modbus exposure.

Risk score, explained

The CVSS 3.1 score of 5.6 (MEDIUM) balances several factors: the vulnerability requires network access (AV:N) but high attack complexity (AC:H), no privileges or user interaction, and impacts confidentiality, integrity, and availability equally but minimally (C:L/I:L/A:L). The score does not account for the existence of public exploit code or the prevalence of PcapPlusPlus in real deployments, both of which elevate practical risk beyond the base score. Organizations should supplement CVSS with threat modeling considering their specific use of the library.

Frequently asked questions