CVE-2026-71263
CriticalCVSS 9.1Summary
The LINUXTCP port of FreeModbus has an off-by-one bounds check in xMBPortTCPPool(). The condition `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` instead of >= allows a 263-byte frame to pass, causing a 7-byte buffer overflow. A single Modbus TCP packet can trigger the overflow.
Risk Assessment
An unauthenticated attacker can cause a denial of service or potentially execute arbitrary code. This may disrupt industrial systems.
Recommendation
Update FreeModbus to a patched version or apply a fix changing the condition to >=. Restrict access to the Modbus TCP port.
Original NVD description (English source)
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.