CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263

The FreeModbus LINUXTCP port has a concrete defect in xMBPortTCPPool(): the code uses a strict greater-than check (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE) against a 263-byte MB_TCP_BUF_SIZE limit. When an MBAP frame with Length 264 is processed, usTCPFrameBytesLeft becomes 263, the check passes...

CVE-2026-71263: Out-of-bounds Write

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...