The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cwalter-at |
|
No data.
No data.
References
History
Mon, 10 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication. | The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. |
| Title | FreeModbus - LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() | FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() |
Mon, 10 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() | FreeModbus - LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() |
Wed, 05 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 05 Aug 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cwalter-at
Cwalter-at freemodbus |
|
| Vendors & Products |
Cwalter-at
Cwalter-at freemodbus |
Wed, 05 Aug 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication. | |
| Title | FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() | |
| Weaknesses | CWE-787 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published: 2026-08-05T12:26:11.423Z
Updated: 2026-08-10T11:46:28.356Z
Reserved: 2026-08-05T12:23:34.966Z
Link: CVE-2026-71263
Vulnrichment
Updated: 2026-08-05T15:39:30.673Z
NVD
Status : Received
Published: 2026-08-05T13:24:50.473
Modified: 2026-08-10T12:17:28.710
Link: CVE-2026-71263
Redhat
No data.