BACnet Stack’s decode_signed32() reconstructs 32‑bit signed integers from four APDU bytes. When any byte has its most‑significant bit set, the signed left‑shift operation overflows a 32‑bit signed int, triggering undefined behavior per the C standard. The library reports thousands of violations per minute when processing such input, indicating that maliciously crafted BACnet frames can cause unstable or erratic stack behavior. The undefined behavior may result in crashes or corruption of data, thereby affecting the reliability or integrity of devices using the stack.

All versions of BACnet Stack prior to 1.4.3, including embedded systems that deploy the open‑source library, are affected. Version 1.4.3 and later contain the fix that eliminates the problematic shift operation.

The CVSS score of 3.7 indicates low severity. No EPSS score is currently available, and the issue is not listed in CISA’s KEV catalog. The attack vector is likely remote over the BACnet network; an attacker would need to send BACnet frames that contain signed‑integer property values with high‑bit set bytes to activate the undefined behavior. While the weakness could cause crashes or unpredictable behavior, no evidence of remote code execution has been reported, keeping the overall risk low for organizations that rely on the stack.