CVE-2026-71263
Received Received - Intake

Buffer Overflow in FreeModbus LINUXTCP Port

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71263
EUVD
EUVD-2026-53348

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freemodbus freemodbus *
christian_walter freemodbus 1.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an off-by-one buffer overflow in the FreeModbus library's LINUXTCP port. The flaw occurs in the xMBPortTCPPool() function where a strict greater-than check against a 263-byte buffer size allows a crafted Modbus TCP packet with a Length field of 264 to overflow the buffer by 7 bytes. This happens because the check fails to account for the exact buffer size limit, causing data to overwrite adjacent memory.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed Modbus TCP packets with a Length field of 264 bytes. Use network traffic analyzers like Wireshark to filter Modbus TCP traffic and inspect packet lengths. Check for crashes or memory corruption in FreeModbus applications after receiving such packets.

Impact Analysis

This vulnerability allows a remote attacker to send a single unauthenticated Modbus TCP packet that triggers a buffer overflow. This could lead to arbitrary code execution, denial of service, or data corruption on systems running vulnerable FreeModbus versions. The impact depends on the system's use of FreeModbus, particularly in embedded devices managing Modbus TCP communications.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data corruption in systems handling sensitive data, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. The buffer overflow may allow attackers to manipulate system behavior or access restricted memory, compromising compliance with data protection standards.

Mitigation Strategies

Immediately update FreeModbus to the latest patched version. If unavailable, apply input validation to reject Modbus TCP packets with Length fields exceeding 263 bytes. Use network firewalls to block unauthorized Modbus TCP traffic. Monitor systems for signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart