CVE-2026-41475

BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser

Published Apr 24, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.

Analysis

Technical impact

BACnet Stack contains an out‑of‑bounds read in the WritePropertyMultiple decoder. A truncated request triggers the deprecated decode_tag_number_and_value() function, which performs no bounds checking and allows an attacker to read 1‑7 bytes beyond the allocated buffer. The resulting information disclosure can leak sensitive memory contents and may cause a crash. This flaw is classified as CWE-125.

Affected Systems

The vulnerability affects the open‑source bacnet‑stack library used in embedded BACnet devices. Any installation of bacnet‑stack prior to version 1.4.3 is impacted. No specific device models are listed, but any embedded system or gateway that incorporates this library is potentially exposed.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploit attempts are currently rare, and the flaw is not listed in CISA's KEV catalogue. Attackers can exploit the flaw remotely over BACnet/IP without authentication, simply by sending a crafted packet to the target device. While the probability of exploitation appears low at present, the impact of information disclosure on industrial control systems justifies proactive mitigation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

bacnet-stack

affected

Version	Status	Constraints
`>= 1.4.0, < 1.4.3`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:bacnetstack:bacnet_stack::::::::
	cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1::::::
	cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2::::::
	cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc3::::::

No data.

Vendor Product Versions

Bacnetstack

Bacnet Stack

Version	Status	Scheme	Platform
`[1.4.0,1.4.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the bacnet‑stack library to version 1.4.3 or later.
If an upgrade cannot be performed immediately, block or restrict access to the WritePropertyMultiple service or tighten firewall rules to limit BACnet/IP traffic from untrusted sources.
Continuously monitor device logs for crashes or anomalies that might indicate attempted exploitation.

Generated by OpenCVE AI on April 28, 2026 at 13:34 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.482% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmv

History

Apr 28, 2026 3:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:bacnetstack:bacnet_stack:::::::: cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:::::: cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:::::: cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc3::::::
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Apr 27, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bacnetstack Bacnetstack bacnet Stack
Vendors & Products		Bacnetstack Bacnetstack bacnet Stack

Apr 27, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 24, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.
Title		BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
Weaknesses		CWE-125
References		https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmv
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`