CVE-2024-36843

What it actually does

Heap-based buffer overflow in modbus_mapping_free() allows out-of-bounds memory writes during structure deallocation, leading to memory corruption.

Why it matters to the business

Applications using the library for industrial or device communication can crash or allow remote code execution, causing downtime in control systems and potential unauthorized access to connected equipment.

How an attack unfolds

An attacker supplies a specially crafted Modbus mapping structure that triggers the overflow inside modbus_mapping_free when the library attempts to release associated memory.

How to fix it

Upgrade libmodbus to a version containing the fix for the heap overflow in modbus_mapping_free(). Rebuild and redeploy all dependent applications. If an immediate update is not possible, isolate affected services behind network controls that restrict untrusted Modbus traffic.

How to confirm the fix worked

Confirm the installed libmodbus version is newer than 3.1.6, run regression tests that exercise modbus_mapping allocation and free paths, and monitor for segmentation faults or heap sanitizer errors under load.

Typical attack path

1. Locate a process or service linked against the vulnerable libmodbus library
2. Send a maliciously formed request that populates a modbus_mapping structure
3. Trigger modbus_mapping_free() via normal session teardown or error path
4. Leverage the resulting heap corruption for code execution or denial of service

How to detect it

Search application and system logs for unexpected crashes or heap-related errors in processes that use libmodbus; correlate with Modbus session teardown events and review memory dumps for corruption artifacts around mapping structures.

What your security team should do

• Prioritize patching all instances of libmodbus to a fixed release
• Inventory software that statically or dynamically links the library
• Restrict exposure of Modbus endpoints to trusted networks only
• Add memory-safety instrumentation to development and CI pipelines for dependent projects