CVE-2026-71263 cwalter-at CVE debrief

Who should care

Users of FreeModbus LINUXTCP port, network administrators, and security teams responsible for industrial control systems and Modbus TCP implementations should review and address this vulnerability. Affected operators and platforms should be identified, and vulnerability management and security teams should prioritize remediation efforts. Security teams should also monitor for suspicious Modbus TCP traffic and implement compensating controls for unauthenticated access. Asset inventory and rollback/change windows may be necessary for remediation efforts. Source tracking and exposure review are recommended to ensure complete remediation.

Technical summary

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos.

Defensive priority

Critical vulnerability in FreeModbus LINUXTCP port requires immediate attention due to unauthenticated remote code execution risk.

Recommended defensive actions

• Apply vendor patch or update to fixed version
• Restrict access to Modbus TCP port
• Monitor for suspicious Modbus TCP traffic
• Implement compensating controls for unauthenticated access
• Perform exposure review for affected deployments
• Conduct asset inventory to identify potentially impacted systems
• Track remediation progress and verify exposure reduction

Evidence notes

Evidence from official CVE and NVD sources confirms an off-by-one bounds check vulnerability in FreeModbus LINUXTCP port. The vulnerability allows for unauthenticated remote code execution with a CVSS score of 9.1. Affected deployments should be identified and verified for exposure. Official advisories and CVE records should be reviewed for scope, severity, and vendor guidance. Compensating controls may be necessary while remediation is planned and verified.

Official resources