What’s Vulnerable › Vulnerabilities

CVE-2026-71263: FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-24
• Weakness: CWE-787

Description

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.

Affected products

• cwalter-at FreeModbus: all versions

References

• https://github.com/cwalter-at/freemodbus
• https://github.com/cwalter-at/freemodbus/blob/master/demo/LINUXTCP/port/porttcp.c

Get alerted when CVE-2026-71263 or the next vulnerability affects your stack