Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.
Published: 2026-04-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

BACnet Stack contains an out‑of‑bounds read in the WritePropertyMultiple decoder. A truncated request triggers the deprecated decode_tag_number_and_value() function, which performs no bounds checking and allows an attacker to read 1‑7 bytes beyond the allocated buffer. The resulting information disclosure can leak sensitive memory contents and may cause a crash. This flaw is classified as CWE-125.

Affected Systems

The vulnerability affects the open‑source bacnet‑stack library used in embedded BACnet devices. Any installation of bacnet‑stack prior to version 1.4.3 is impacted. No specific device models are listed, but any embedded system or gateway that incorporates this library is potentially exposed.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploit attempts are currently rare, and the flaw is not listed in CISA's KEV catalogue. Attackers can exploit the flaw remotely over BACnet/IP without authentication, simply by sending a crafted packet to the target device. While the probability of exploitation appears low at present, the impact of information disclosure on industrial control systems justifies proactive mitigation.

Generated by OpenCVE AI on April 28, 2026 at 13:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the bacnet‑stack library to version 1.4.3 or later.
  • If an upgrade cannot be performed immediately, block or restrict access to the WritePropertyMultiple service or tighten firewall rules to limit BACnet/IP traffic from untrusted sources.
  • Continuously monitor device logs for crashes or anomalies that might indicate attempted exploitation.

Generated by OpenCVE AI on April 28, 2026 at 13:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*
cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*
cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*
cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc3:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Mon, 27 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Bacnetstack
Bacnetstack bacnet Stack
Vendors & Products Bacnetstack
Bacnetstack bacnet Stack

Mon, 27 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Apr 2026 20:00:00 +0000

Type Values Removed Values Added
Description BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.
Title BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Bacnetstack Bacnet Stack
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-27T13:41:36.425Z

Reserved: 2026-04-20T16:14:19.004Z

Link: CVE-2026-41475

cve-icon Vulnrichment

Updated: 2026-04-27T13:41:20.425Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-24T20:16:28.063

Modified: 2026-04-28T15:36:04.643

Link: CVE-2026-41475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T13:45:06Z

Weaknesses