Junglewise Threat Intelligence

CVE-2026-13590: seladb PcapPlusPlus heap overflow in Modbus Protocol Handler

CVE-2026-13590 · Severity: medium · CVSS 5.6 · Published 2026-06-29

Technologies: Seladb PcapPlusPlus. Vendors: Seladb.

Executive brief

A security vulnerability exists in PcapPlusPlus, a popular library used for capturing and analyzing network traffic. The flaw occurs when the library processes specially crafted Modbus network packets that are shorter than expected, which can cause the application using the library to crash. This could lead to a denial-of-service, impacting the availability of network monitoring or security tools that rely on this software.

Technical details

A heap-based buffer overflow vulnerability exists in PcapPlusPlus 25.05 within the Modbus Protocol Handler. The root cause is a lack of bounds checking in the `pcpp::ModbusLayer::getLength` function (and related getters like `getTransactionId`) located in `ModbusLayer.cpp`. When the library attempts to parse truncated Modbus TCP packets (shorter than the required 6-8 bytes), it performs out-of-bounds memory reads. A remote attacker can exploit this by sending malformed Modbus traffic to a system running the library, potentially leading to a denial-of-service (DoS) via application crash. A patch has been released in commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454 which implements an `isDataValid` check.

Affected products

  • seladb PcapPlusPlus 25.05

Timeline

  • 2026-05-26: disclosed: Issue reported on GitHub repository
  • 2026-06-24: patched: Fix merged into development branch
  • 2026-06-29: advisory: CVE published and NVD entry created

References

Related threats