CVE-2019-14462

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...

9.1 CriticalPublic exploitFix available

CVE-2019-14462 is a critical vulnerability (CVSS 9.1) in Libmodbus, published July 31, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in libmodbus 3.1.6-1.

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

1.98%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: CVE-2019-14462
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: CVE-2019-14462
Updated: 2026-11-02

EUVDEUVD-2019-5648 No score

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: EUVD-2019-5648
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8rvx-q9m8-37qc No score

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: GHSA-8rvx-q9m8-37qc
Weakness: CWE-125
Updated: 2026-11-02

OSV 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: CVE-2019-14462
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-14462 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: DEBIAN-CVE-2019-14462
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-14462 9.1

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.

Record: UBUNTU-CVE-2019-14462
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-5173-1 No score

libmodbus vulnerabilities

It was discovered that libmodbus incorrectly handled inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record: USN-5173-1
Updated: 2026-11-02

OSVUSN-5173-2 No score

libmodbus vulnerabilities

USN-5173-1 fixed vulnerabilities in libmodbus. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libmodbus incorrectly handled inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Record: USN-5173-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libmodbus` Debian:12	before 3.1.6-1	3.1.6-1
`libmodbus` Debian:13	before 3.1.6-1	3.1.6-1
`libmodbus` Debian:14	before 3.1.6-1	3.1.6-1
`libmodbus` Debian:9	before 3.0.6-2+deb9u1, plus listed versions 3.0.6-2	3.0.6-2+deb9u1
`libmodbus` Ubuntu:Pro:14.04:LTS	before 3.0.5-1ubuntu0.1~esm1, plus listed versions 3.0.4-13.0.5-1	3.0.5-1ubuntu0.1~esm1
`libmodbus` Ubuntu:Pro:16.04:LTS	before 3.0.6-1ubuntu0.1~esm1, plus listed versions 3.0.6-1	3.0.6-1ubuntu0.1~esm1
`libmodbus` Ubuntu:18.04:LTS	before 3.0.6-2+deb9u1build0.18.04.1, plus listed versions 3.0.6-2	3.0.6-2+deb9u1build0.18.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	spanwich/sel4-ics-gateway-demo	2026-01-01

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 9 moreShow less