The LINUXTCP port of FreeModbus contains an off-by-one bounds check vulnerability (CWE-787) in the xMBPortTCPPool function located in demo/LINUXTCP/port/porttcp.c. The bounds check incorrectly uses a strict greater-than comparison rather than a greater-than-or-equal comparison against the 263-byte MB_TCP_BUF_SIZE limit. This error allows an out-of-bounds write or read beyond the buffer boundary, which can compromise the integrity and availability of the system. The vulnerability has a CVSS 3.1 score of 9.1 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on integrity and availability. No patch or official remediation has been published yet, and there are no known exploits in the wild.

This vulnerability can lead to out-of-bounds memory access due to an off-by-one error in buffer boundary checking. The impact includes potential denial of service or corruption of memory, affecting the integrity and availability of the FreeModbus LINUXTCP port. The CVSS score of 9.1 indicates critical severity with remote exploitability and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific workaround or temporary fix is currently documented.