The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool() (demo/LINUXTCP/port/porttcp.c). The check `if (usTCPFrameBytesLeft > MB_…

The LINUXTCP port of FreeModbus contains an off-by-one bounds check vulnerability in the xMBPortTCPPool() function located in demo/LINUXTCP/port/porttcp.c. The flawed check uses strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit. An attacker can craft an MBAP frame with a Length field of 264, causing usTCPFrameBytesLeft to equal 263, which bypasses the check. The subsequent recv() call writes up to 263 bytes starting at buffer offset 7 into the 263-byte static buffer aucTCPBuf, overflowing it by 7 bytes into the adjacent static variable usTCPBufPos. The vulnerability is remotely exploitable via a single unauthenticated Modbus TCP packet, as Modbus has no built-in authentication mechanism. This affects industrial control system environments where FreeModbus is deployed on Linux TCP systems.