CVE-2026-71263
FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.
| CWE | CWE-787 |
| Vendor | cwalter-at |
| Product | freemodbus |
| Published | Aug 5, 2026 |
| Last Updated | Aug 5, 2026 |
Get instant alerts for cwalter-at freemodbus
Be the first to know when new critical vulnerabilities affecting cwalter-at freemodbus are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H