libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in readiostatus function in src/modbus.c.