CVE-2026-71263
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-787
Escritura fuera de límites
Fecha de publicación:
05/08/2026
Última modificación:
05/08/2026
Descripción
*** Pendiente de traducción *** The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.
Impacto
Puntuación base 3.x
9.10
Gravedad 3.x
CRÍTICA