CVE-2026-71263

Name of the Vulnerable Software and Affected Versions FreeModbus LINUXTCP port (affected versions not specified)

Description The LINUXTCP port of FreeModbus contains an off-by-one bounds check within the xMBPortTCPPool() function located in demo/LINUXTCP/port/porttcp.c. The issue occurs because the check if (usTCPFrameBytesLeft > MB TCP BUF SIZE) uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB TCP BUF SIZE limit. An MBAP (Modbus Application Protocol) frame with a Length field of 264 results in usTCPFrameBytesLeft being 263, which bypasses the check. Consequently, the recv() function writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, causing a 7-byte overflow into the adjacent static variable usTCPBufPos. This can be triggered by a single crafted, unauthenticated Modbus TCP packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.