CVE-2026-71263 Details
Description
The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.
An off-by-one bounds check vulnerability has been identified in the LINUXTCP port of FreeModbus, specifically within the function xMBPortTCPPool(). The issue arises from a strict greater-than comparison that improperly validates the length of incoming MBAP frames. This flaw allows a crafted, unauthenticated Modbus TCP packet to overflow a static buffer by 7 bytes, potentially leading to arbitrary code execution. The vulnerability is present in FreeModbus versions prior to 1.6.0.
Users are advised to update to FreeModbus version 1.6.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cwalter-at/freemodbus | TuranSec | Vendor |
| https://github.com/cwalter-at/freemodbus/blob/master/demo/LINUXTCP/port/porttcp.c | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| FreeModbus | 1.6.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |