CVE-2024-10918 is a medium severity stack buffer overflow (CVSS 4.8) in libmodbus 3.1.10. The buffer for the Modbus response can overflow when the library replies to a request of unexpected length. Nozomi Networks, which reported it, suggests updating to libmodbus 3.1.11.
What's affected
The CVE record and the Nozomi Networks Labs advisory list libmodbus v3.1.10 as affected, and the advisory's solution is to update to v3.1.11. The advisory is dated 24 February 2025 and credits the finder. It lists no mitigations.
libmodbus is a C library used by software that talks Modbus, a protocol common in industrial and building systems. It is often pulled in as a system package or built into a vendor's firmware, so you might be running it without choosing it.
How to check if you're exposed
On Linux, ask the package manager or pkg-config for the library version:
pkg-config --modversion libmodbus
dpkg -l | grep -i libmodbus
rpm -qa | grep -i libmodbus
For container images, scan the image and look for libmodbus in the package list. The demo below shows what an image scan looks like. For source projects, check whether libmodbus is vendored in a third party directory, because a copy inside your repository will not show up in the package manager.
If a vendor device uses libmodbus, ask the vendor which version is inside its firmware.
What to do now
- Find where libmodbus is installed or vendored, in hosts, images and source trees.
- Update to 3.1.11 or later, using your distribution package if one is available.
- Rebuild and redeploy container images and firmware that bundle the library.
- Keep Modbus devices on isolated industrial networks, and do not expose them to the internet.
- Ask equipment vendors about their libmodbus version and update plans.
Why it matters
This is a stack based buffer overflow (CWE-121), a form of out of bounds write (CWE-787). The code writes a response into a fixed size buffer on the stack, and an unexpected request length makes the reply longer than the space reserved for it. Writing past the end of a stack buffer can corrupt neighbouring data or crash the program, and in some cases it can be steered into code execution.
The record scores it 4.8, with a network vector, high complexity, and a low impact on integrity and availability, which is why it ranks as medium. Modbus gear is long lived and rarely patched, so a medium issue in a library that is embedded in many devices can stay present for years. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory describes no attacks in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
libmodbus 3.1.11, as suggested by the Nozomi Networks advisory.
Why does an embedded library matter?
Many products bundle libmodbus. You may need the vendor to ship an update, so ask which version each device contains.
Sources
Last reviewed: 19 October 2026.
