BACnet Stack contains an off-by-one error in the rpm_decode_object_id function used to parse the ReadPropertyMultiple service. The function permits a 5‑byte payload, but then reads the sixth byte, yielding a single out‑of‑bounds read that can crash the process. The vulnerability is unauthenticated and remote, allowing an attacker to send a crafted BACnet request from any network location to trigger the crash. The impact is primarily a denial‑of‑service; the read only exposes a single byte, making exploitation of higher‑level weaknesses unlikely without additional information. The known weakness types are CWE‑125 (Out‑of‑Bounds Read) and CWE‑193 (Off‑by‑One Error).

Any deployment of bacnet-stack before version 1.4.3 that has the ReadPropertyMultiple confirmed service handler enabled, which is the default in the reference server. The stack is commonly used in embedded BACnet devices, making embedded controllers and building automation equipment potential targets.

The CVSS score of 8.7 reflects high severity, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no confirmed exploits yet. An attacker can exploit the issue simply by sending a malformed BACnet message over the network; no credentials are required. Because the flaw results in a crash rather than remote code execution, the risk is confined to service interruption, which can be critical in safety‑critical or mission‑critical environments.