https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T10:31:14.579612+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349656 EUVD-2026-349656 2026-10-08T10:31:14.633019+00:00 EUVD-2026-349656 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71263 fkie_cve-2026-71263 2026-10-08T10:31:14.633064+00:00

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.

 https://cve.radiocsirt.org/vuln/ghsa-cjvm-2pqq-6v6h GHSA-cjvm-2pqq-6v6h 2026-10-08T10:31:14.633099+00:00

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An MBAP frame with a Length field of 264 makes usTCPFrameBytesLeft equal to 263, which passes the flawed check, and the subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. A single crafted, unauthenticated Modbus TCP packet triggers the overflow, since Modbus has no built-in authentication.