by Kastro
Paper/Archive/CVE-2026-71263

CVE-2026-71263

cwalter-at FreeModbus — FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.9.429 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.

Affected

ProductAffectedFixed inSource
FreeModbus≤ *–CNA

Scores by source

TuranSec (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupgithub.com/cwalter-at/freemodbuswriteupgithub.com/cwalter-at/freemodbus/blob/master/demo/LINUXTCP/port/porttcp.c