CVE-2026-13590: PcapPlusPlus Buffer Overflow Vulnerability

CVE-2026-13590 Overview

CVE-2026-13590 is a heap-based buffer overflow vulnerability in seladb PcapPlusPlus 25.05, an open-source C++ library for capturing, parsing, and crafting network packets. The flaw exists in the pcpp::ModbusLayer::getLength function within Packet++/header/ModbusLayer.h, part of the Modbus Protocol Handler component. Manipulation of the length argument triggers a heap-based buffer overflow when the parser processes truncated Modbus packets. The vulnerability can be exploited remotely, but attack complexity is high and exploitation is considered difficult. A public exploit has been released, and the issue is tracked under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers can send crafted truncated Modbus packets to trigger a heap-based buffer overflow in applications built on PcapPlusPlus, potentially leading to memory corruption, information disclosure, or denial of service.

Affected Products

seladb PcapPlusPlus version 25.05
Applications embedding the PcapPlusPlus Packet++ library for Modbus parsing
Network monitoring and industrial control system (ICS) tooling that links against the vulnerable ModbusLayer component

Discovery Timeline

2026-06-29 - CVE-2026-13590 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13590

Vulnerability Analysis

The vulnerability resides in the Modbus protocol dissector of PcapPlusPlus. When a TCP payload is dispatched to ModbusLayer based on the destination port (502), the constructor accesses fields in the modbus_header structure without first verifying that the payload contains enough bytes to hold a full Modbus header. A truncated packet causes getLength and related header accessors to read beyond the allocated heap buffer, producing an out-of-bounds heap read. The condition is classified as [CWE-119] and represents a classic missing length validation before struct-based parsing.

Root Cause

The root cause is the absence of a bounds check before parsing incoming Modbus data. The pre-patch TcpLayer code selected the next layer solely on port match (ModbusLayer::isModbusPort(portDst)) without validating whether the remaining payload length satisfied sizeof(modbus_header). Any application feeding untrusted PCAP data or live traffic to the parser inherits this deficiency.

Attack Vector

An attacker delivers a crafted TCP segment with destination port 502 and a payload smaller than the Modbus header. When PcapPlusPlus parses the frame, the ModbusLayer constructor dereferences header fields beyond the buffer boundary. Delivery paths include live capture on a monitored interface, replay of malicious PCAP files, or piping crafted traffic through tools that use PcapPlusPlus for dissection.

// Patch: Add isDataValid() check before constructing ModbusLayer
// Source: https://github.com/seladb/PcapPlusPlus/commit/4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454

// Packet++/header/ModbusLayer.h
/// A static method that checks whether the data is large enough to hold a MODBUS header
/// @param[in] data A pointer to the raw data
/// @param[in] dataSize The size of the data in bytes
/// @return True if the data is large enough to be parsed as a MODBUS layer, false otherwise
static bool isDataValid(const uint8_t* data, size_t dataSize)
{
    return data != nullptr && dataSize >= sizeof(modbus_header);
}

cpp

// Packet++/src/TcpLayer.cpp - guard next-layer construction with the new validator
// Source: https://github.com/seladb/PcapPlusPlus/commit/4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454

else if (ModbusLayer::isModbusPort(portDst) && ModbusLayer::isDataValid(payload, payloadLen))
{
    constructNextLayer<ModbusLayer>(payload, payloadLen, getAttachedPacket());
}

The patch introduces isDataValid() and requires it to return true before TcpLayer instantiates a ModbusLayer, eliminating the out-of-bounds access.

Detection Methods for CVE-2026-13590

Indicators of Compromise

Application crashes or AddressSanitizer heap-buffer-overflow reports originating in ModbusLayer or TcpLayer::parseNextLayer call paths.
Inbound TCP segments to port 502 whose payload length is smaller than the Modbus header size.
PCAP files sourced from untrusted origins containing malformed Modbus frames referenced in the public PoC.

Detection Strategies

Perform binary or dependency scanning to enumerate software linking against PcapPlusPlus 25.05 or earlier vulnerable builds.
Deploy IDS or NSM signatures that flag TCP/502 packets with payloads shorter than the expected Modbus header length.
Run fuzz regression tests against parsers using the published proof-of-concept archive referenced in GitHub Issue #2155.

Monitoring Recommendations

Log and alert on repeated parser failures or segmentation faults in services that ingest live Modbus traffic.
Monitor ICS/OT network segments for anomalous short Modbus/TCP flows that do not match legitimate PLC session patterns.
Track upstream advisories on the PcapPlusPlus repository for follow-on fixes and regression tests.

How to Mitigate CVE-2026-13590

Immediate Actions Required

Rebuild and redistribute any software that statically or dynamically links PcapPlusPlus against a build that includes commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454.
Restrict PcapPlusPlus-based analyzers from processing PCAP files or live traffic sourced from untrusted networks until patched.
Segment ICS networks so that Modbus/TCP traffic is only reachable from authorized engineering workstations and historians.

Patch Information

The fix is delivered in commit 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454, merged via Pull Request #2159. The patch adds ModbusLayer::isDataValid() and requires it in TcpLayer before constructing a ModbusLayer, preventing out-of-bounds reads on truncated Modbus packets.

Workarounds

Disable Modbus dissection in downstream tooling if the option is exposed, or filter TCP/502 traffic out of capture pipelines.
Apply the upstream diff from PR #2159 as an out-of-tree patch when an official release is not yet available.
Enforce upstream firewall ACLs that drop malformed short Modbus packets before they reach parsing hosts.

bash

# Build PcapPlusPlus from a patched source tree
git clone https://github.com/seladb/PcapPlusPlus.git
cd PcapPlusPlus
git checkout 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j
sudo cmake --install build