{"id":"CVE-2019-14462","aliases":["DEBIAN-CVE-2019-14462","DLA-2825-1","EUVD-2019-5648","GHSA-8rvx-q9m8-37qc","UBUNTU-CVE-2019-14462","USN-5173-1","USN-5173-2"],"status":"published","title":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01981,"percentile":0.8082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125"],"published":"2019-07-31T22:03:30Z","modified":"2026-10-20T13:55:59Z","exploits":[{"source":"pocgithub","id":"spanwich/sel4-ics-gateway-demo","title":"spanwich/sel4-ics-gateway-demo","date":"2026-01-01","url":"https://github.com/spanwich/sel4-ics-gateway-demo"}],"fixes":[{"ecosystem":"Debian:12","package":"libmodbus","fixed_in":["3.1.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmodbus","fixed_in":["3.1.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmodbus","fixed_in":["3.1.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmodbus","fixed_in":["3.0.5-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodbus","fixed_in":["3.0.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libmodbus","fixed_in":["3.0.6-2+deb9u1build0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-2+deb9u1"}]}],"versions":["3.0.6-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1ubuntu0.1~esm1"}]}],"versions":["3.0.4-1","3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1ubuntu0.1~esm1"}]}],"versions":["3.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-2+deb9u1build0.18.04.1"}]}],"versions":["3.0.6-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-2+deb9u1build0.18.04.1"}]}],"versions":["3.0.6-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1ubuntu0.1~esm1"}]}],"versions":["3.0.4-1","3.0.5-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1ubuntu0.1~esm1"}]}],"versions":["3.0.6-1"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libmodbus","product":"libmodbus"}],"references":[{"url":"https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://libmodbus.org/2019/stable-and-development-releases/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00020.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14462"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233/"},{"url":"https://github.com/advisories/GHSA-8rvx-q9m8-37qc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14462","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14462","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5173-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14462","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5173-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14463","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-14462","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2019-07-31T22:03:30Z","modified":"2024-08-05T00:19:41.129Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5648","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2019-07-31T22:03:30Z","modified":"2024-08-05T00:19:41Z","updated_at":"2026-11-03T02:40:39.508511Z"}],"ghsa":[{"id":"GHSA-8rvx-q9m8-37qc","title":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2022-05-24T16:52:04Z","modified":"2023-01-28T05:06:30Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:44:26.339775Z"}],"nvd":[{"id":"CVE-2019-14462","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2019-07-31T23:15:10.95Z","modified":"2026-06-17T02:18:28.213Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-14462","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2019-07-31T23:15:10.95Z","modified":"2026-10-20T13:55:59.82712803Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14462","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2019-07-31T23:15:10.95Z","modified":"2026-09-21T07:01:08.492710771Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-14462","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.","status":"published","published":"2019-07-31T23:15:00Z","modified":"2026-04-22T12:10:20.555306Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2825-1","title":"libmodbus - security update","status":"published","published":"2021-11-22T00:00:00Z","modified":"2026-03-09T01:18:41.322452Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5173-1","title":"libmodbus vulnerabilities","description":"It was discovered that libmodbus incorrectly handled inputs. An attacker\ncould possibly use this issue to cause a denial of service or other\nunspecified impact.\n","status":"published","published":"2021-12-06T12:54:47Z","modified":"2026-04-22T10:19:28.942827Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5173-2","title":"libmodbus vulnerabilities","description":"USN-5173-1 fixed vulnerabilities in libmodbus.\nThis update provides the corresponding updates for Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libmodbus incorrectly handled inputs. An attacker\n could possibly use this issue to cause a denial of service or other\n unspecified impact.\n","status":"published","published":"2021-12-09T12:08:16Z","modified":"2026-06-29T13:49:34.946675264Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}