{"id":"CVE-2019-14463","aliases":["DEBIAN-CVE-2019-14463","DLA-2825-1","EUVD-2019-5649","GHSA-p6hf-772c-jqqx","UBUNTU-CVE-2019-14463","USN-5173-1","USN-5173-2"],"status":"published","title":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01927,"percentile":0.80145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-07-31T22:03:44Z","modified":"2026-10-20T13:56:00Z","fixes":[{"ecosystem":"Debian:12","package":"libmodbus","fixed_in":["3.1.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmodbus","fixed_in":["3.1.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmodbus","fixed_in":["3.1.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmodbus","fixed_in":["3.0.5-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodbus","fixed_in":["3.0.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libmodbus","fixed_in":["3.0.6-2+deb9u1build0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-2+deb9u1"}]}],"versions":["3.0.6-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1ubuntu0.1~esm1"}]}],"versions":["3.0.4-1","3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1ubuntu0.1~esm1"}]}],"versions":["3.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-2+deb9u1build0.18.04.1"}]}],"versions":["3.0.6-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-2+deb9u1build0.18.04.1"}]}],"versions":["3.0.6-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1ubuntu0.1~esm1"}]}],"versions":["3.0.4-1","3.0.5-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1ubuntu0.1~esm1"}]}],"versions":["3.0.6-1"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libmodbus","product":"libmodbus"}],"references":[{"url":"https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://libmodbus.org/2019/stable-and-development-releases/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00020.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14463"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233/"},{"url":"https://github.com/advisories/GHSA-p6hf-772c-jqqx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14463","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14463","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5173-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14463","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5173-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14462","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-14463","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2019-07-31T22:03:44Z","modified":"2024-08-05T00:19:41.277Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5649","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2019-07-31T22:03:44Z","modified":"2024-08-05T00:19:41Z","updated_at":"2026-11-03T02:40:39.508511Z"}],"ghsa":[{"id":"GHSA-p6hf-772c-jqqx","title":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of...","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2022-05-24T16:52:04Z","modified":"2023-01-28T05:06:04Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:44:24.376453Z"}],"nvd":[{"id":"CVE-2019-14463","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2019-07-31T23:15:11.013Z","modified":"2026-06-17T02:18:28.367Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-14463","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2019-07-31T23:15:11.013Z","modified":"2026-10-20T13:56:00.217903743Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14463","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2019-07-31T23:15:11.013Z","modified":"2026-09-21T07:01:07.954716498Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-14463","description":"An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.","status":"published","published":"2019-07-31T23:15:00Z","modified":"2026-04-22T12:11:00.401019Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2825-1","title":"libmodbus - security update","status":"published","published":"2021-11-22T00:00:00Z","modified":"2026-03-09T01:18:41.322452Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5173-1","title":"libmodbus vulnerabilities","description":"It was discovered that libmodbus incorrectly handled inputs. An attacker\ncould possibly use this issue to cause a denial of service or other\nunspecified impact.\n","status":"published","published":"2021-12-06T12:54:47Z","modified":"2026-04-22T10:19:28.942827Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5173-2","title":"libmodbus vulnerabilities","description":"USN-5173-1 fixed vulnerabilities in libmodbus.\nThis update provides the corresponding updates for Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that libmodbus incorrectly handled inputs. An attacker\n could possibly use this issue to cause a denial of service or other\n unspecified impact.\n","status":"published","published":"2021-12-09T12:08:16Z","modified":"2026-06-29T13:49:34.946675264Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}