CVE-2019-14463

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...

9.1 CriticalFix available

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

1.93%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: CVE-2019-14463
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: CVE-2019-14463
Updated: 2026-11-02

EUVDEUVD-2019-5649 No score

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: EUVD-2019-5649
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p6hf-772c-jqqx No score

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: GHSA-p6hf-772c-jqqx
Weakness: CWE-125
Updated: 2026-11-02

OSV 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: CVE-2019-14463
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-14463 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: DEBIAN-CVE-2019-14463
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-14463 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.

Record: UBUNTU-CVE-2019-14463
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-5173-1 No score

libmodbus vulnerabilities

It was discovered that libmodbus incorrectly handled inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record: USN-5173-1
Updated: 2026-11-02

OSVUSN-5173-2 No score

libmodbus vulnerabilities

USN-5173-1 fixed vulnerabilities in libmodbus. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libmodbus incorrectly handled inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record: USN-5173-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libmodbus` Debian:12	before 3.1.6-1	3.1.6-1
`libmodbus` Debian:13	before 3.1.6-1	3.1.6-1
`libmodbus` Debian:14	before 3.1.6-1	3.1.6-1
`libmodbus` Debian:9	before 3.0.6-2+deb9u1, plus listed versions 3.0.6-2	3.0.6-2+deb9u1
`libmodbus` Ubuntu:Pro:14.04:LTS	before 3.0.5-1ubuntu0.1~esm1, plus listed versions 3.0.4-13.0.5-1	3.0.5-1ubuntu0.1~esm1
`libmodbus` Ubuntu:Pro:16.04:LTS	before 3.0.6-1ubuntu0.1~esm1, plus listed versions 3.0.6-1	3.0.6-1ubuntu0.1~esm1
`libmodbus` Ubuntu:18.04:LTS	before 3.0.6-2+deb9u1build0.18.04.1, plus listed versions 3.0.6-2	3.0.6-2+deb9u1build0.18.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-14463 is a critical vulnerability (CVSS 9.1) in Libmodbus, published July 31, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 79th percentile. Fixed in libmodbus 3.1.6-1.

References

Show 9 moreShow less