The vulnerability is an out-of-bounds read in the bacnet_tag_number_decode routine of the bacnet_stack library version 1.3.1. The function does not validate input lengths before accessing memory, which can cause the stack to read beyond allocated bounds. An attacker exploiting this flaw can trigger a crash or reset, resulting in a denial of service to legitimate users. No evidence suggests that the flaw could be used to compromise confidentiality or integrity.

The affected software is the bacnet_stack library, specifically version 1.3.1. No specific vendors are listed in the CNA data, and the product is distributed as an open‑source library.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of < 1% and the lack of listing in CISA KEV suggest that widespread exploitation has not occurred. The likely attack vector is network‑based, requiring an attacker to send crafted BACnet packets that trigger the vulnerable routine. Because the flaw can crash the stack, the feasibility of exploitation is moderate to high on reachable devices that process BACnet traffic.