Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

CVE-2026-71263: FreeModbus Linux TCP Port Buffer Overflow in xMBPortTCPPool()

CVE-2026-71263 CVE-2026-71263
Summary

FreeModbus's Linux TCP port has a flaw in how it handles incoming data. This could allow an attacker to send a specially crafted message that overflows the buffer, potentially causing the program to crash or behave unexpectedly. To fix this, update to the latest version of FreeModbus.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
cwalter-at freemodbus <= *
Original title
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-...
Original description
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.
nvd CVSS3.1 9.1
Vulnerability type
CWE-787 Out-of-bounds Write
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026