The vulnerability is a length underflow in the WriteProperty decoder of the BACnet Stack library. A specially crafted WriteProperty request causes the decoder to subtract the actual packet size from the declared length, resulting in a negative value that underflows to a large positive number. The oversized value is then passed to the context decoder, triggering an out‑of‑bounds read and ultimately a crash, which translates into a denial‑of‑service condition. The weakness is classified as CWE‑125.

Affected are installations of the open‑source BACnet Stack (bacnet-stack). Versions older than 1.5.0rc4 and 1.4.3rc2 are vulnerable, including the release candidates listed in the CPE data such as 1.4.3rc1, 1.5.0rc1 through rc3 and earlier baseline releases. Embedded devices or systems that serve as BACnet gateways or controllers and use these versions are at risk.

The base score of 7.8 indicates high severity. The EPSS score is below 1 %, suggesting that observed exploitation is rare, and the vulnerability is not yet in the KEV list. However, because the flaw can be triggered by sending a malformed WriteProperty request over the BACnet network, any device exposed to an untrusted network could be targeted. Successful exploitation leads to a crash, disrupting service but not permitting remote code execution or data disclosure. The core risk stems from the reliability assumption of protocol decoding; thus, a DoS can be manifested without privileged access.