The vulnerability exists in the LINUXTCP port of FreeModbus within the xMBPortTCPPool() function (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE)` incorrectly uses a strict greater-than comparison instead of greater-than-or-equal, allowing an MBAP frame with a Length field of 264 to bypass the check. This causes the subsequent recv() call to write up to 263 bytes starting at buffer offset 7 into a 263-byte static buffer (aucTCPBuf), overflowing it by 7 bytes into the adjacent static variable (usTCPBufPos). The overflow can be triggered by a single crafted, unauthenticated Modbus TCP packet, potentially leading to denial of service or other impacts due to memory corruption.

An attacker can send a single crafted Modbus TCP packet to trigger a buffer overflow, potentially causing memory corruption. The vulnerability does not affect confidentiality but impacts integrity and availability, as indicated by the CVSS vector (C:N/I:H/A:H). Since Modbus TCP has no built-in authentication, exploitation does not require credentials. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, network-level controls such as filtering Modbus TCP traffic from untrusted sources may reduce exposure.