CVE-2022-0367

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

7.8 HighFix available

CVE-2022-0367 is a high vulnerability (CVSS 7.8) in Libmodbus, published August 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in libmodbus 3.1.8-r0.

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.46%Down 0.4 points since Aug 30, 2022

What each source reports

NVD Score used 7.8

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: CVE-2022-0367
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-787
Updated: 2026-11-02

CVE List No score

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: CVE-2022-0367
Weakness: CWE-119
Updated: 2026-11-02

EUVDEUVD-2022-15522 No score

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: EUVD-2022-15522
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w46r-g3fx-q46r 7.8

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: GHSA-w46r-g3fx-q46r
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-787
Updated: 2026-11-02

OSVALPINE-CVE-2022-0367 7.8

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: ALPINE-CVE-2022-0367
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVDEBIAN-CVE-2022-0367 7.8

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: DEBIAN-CVE-2022-0367
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

Show 4 moreShow less

OSVJLSEC-2026-1250 7.8

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: JLSEC-2026-1250
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-0367 7.8

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: UBUNTU-CVE-2022-0367
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

Record: CVE-2022-0367
Weakness: CWE-119
Updated: 2026-11-02

OSVopenSUSE-SU-2022:10196-1 No score

Security update for libmodbus

This update for libmodbus fixes the following issues:

CVE-2022-0367: Fixed heap-based Buffer Overflow in modbus_reply (boo#1195124).

Record: openSUSE-SU-2022:10196-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libmodbus` Alpine:v3.16	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.17	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.18	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.19	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.20	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.21	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.22	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.23	before 3.1.8-r0	3.1.8-r0
`libmodbus` Alpine:v3.24	before 3.1.8-r0	3.1.8-r0
`libmodbus` Debian:12	before 3.1.6-2.1	3.1.6-2.1

Show 16 moreShow less

Affected packages
Package	Affected	Fixed
`libmodbus` Debian:13	before 3.1.6-2.1	3.1.6-2.1
`libmodbus` Debian:14	before 3.1.6-2.1	3.1.6-2.1
`libmodbus` Debian:10	before 3.1.4-2+deb10u2, plus listed versions 3.1.4-23.1.4-2+deb10u1	3.1.4-2+deb10u2
`libmodbus` Debian:11	before 3.1.6-2+deb11u1, plus listed versions 3.1.6-2	3.1.6-2+deb11u1
`LibModbus_jll` Julia	before 3.1.10+0	3.1.10+0
`libmodbus` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 3.0.4-13.0.5-13.0.5-1ubuntu0.1~esm1	None known
`libmodbus` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.0.6-13.0.6-1ubuntu0.1~esm1	None known
`libmodbus` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.6-23.0.6-2ubuntu0.1~esm13.0.6-2+deb9u1build0.18.04.1	None known
`libmodbus` Ubuntu:20.04:LTS	All versions, plus listed versions 3.1.6-13.1.6-2	None known
`libmodbus` Ubuntu:22.04:LTS	All versions, plus listed versions 3.1.6-2	None known
`libmodbus` Ubuntu:24.04:LTS	All versions, plus listed versions 3.1.6-2.13.1.10-1ubuntu1	None known
`libmodbus` Ubuntu:25.10	All versions, plus listed versions 3.1.11-2	None known
`libmodbus` Ubuntu:26.10	All versions, plus listed versions 3.1.11-2build13.2.0-1	None known
`libmodbus` Ubuntu:26.04:LTS	All versions, plus listed versions 3.1.11-23.1.11-2build1	None known
`libmodbus` SUSE:Package Hub 15 SP4	before 3.1.6-bp154.2.3.1	3.1.6-bp154.2.3.1
`libmodbus` openSUSE:Leap 15.4	before 3.1.6-bp154.2.3.1	3.1.6-bp154.2.3.1

History

History
When	Changed	Sources
2026-11-03	affected, aliases, references	OSV
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less