Description
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.
Published: 2026-08-05
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an off‑by‑one bounds check in the FreeModbus LINUXTCP port's xMBPortTCPPool function, which incorrectly permits payloads that exceed the defined 263‑byte MB_TCP_BUF_SIZE. This can cause a buffer overflow that may enable an attacker to overwrite memory and potentially execute arbitrary code. The flaw is categorized as CWE‑787.

Affected Systems

The issue affects the LINUXTCP implementation of FreeModbus from the cwalter‑at project. Any instance that compiles the referenced source file (demo/LINUXTCP/port/porttcp.c) is vulnerable. No specific version numbers are provided; any build containing the unpatched code is considered at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.1, indicating critical severity. The EPSS score of < 1% suggests a low probability of immediate exploitation, yet the lack of network‑level protection on Modbus TCP means that any host with network access to the port may send the malformed frame. The flaw is not yet listed in CISA's KEV catalog.

Generated by OpenCVE AI on August 10, 2026 at 21:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Replace or patch the vulnerable xMBPortTCPPool implementation to enforce correct bounds checks for MB_TCP_BUF_SIZE, ensuring no overflow occurs.
  • If a patch is not available, modify the source to validate the incoming frame length against the buffer size before performing recv(), dropping any frames that exceed the limit.
  • Limit incoming Modbus TCP traffic to trusted hosts using firewall rules or network segmentation to reduce exposure.

Generated by OpenCVE AI on August 10, 2026 at 21:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication. The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.
Title FreeModbus - LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() FreeModbus - LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

Wed, 05 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Cwalter-at
Cwalter-at freemodbus
Vendors & Products Cwalter-at
Cwalter-at freemodbus

Wed, 05 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.
Title FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Cwalter-at Freemodbus
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:46:28.356Z

Reserved: 2026-08-05T12:23:34.966Z

Link: CVE-2026-71263

cve-icon Vulnrichment

Updated: 2026-08-05T15:39:30.673Z

cve-icon NVD

Status : Deferred

Published: 2026-08-05T13:24:50.473

Modified: 2026-08-26T17:13:24.800

Link: CVE-2026-71263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T21:45:03Z

Weaknesses