Prior to version 1.4.3, the BACnet Stack library contained an out‑of‑bounds read in the RPM (ReadPropertyMultiple) property decoder. An attacker can send a BACnet/IP packet containing a truncated property list with a single‑byte payload that includes an extended tag marker (0xF9). The deprecated tag parser reads one byte beyond the input buffer, allowing the attacker to read memory that lies outside the allocated region or, if the read fails, causing the stack to crash. This flaw is categorized as CWE‑125 and can lead to data exposure or denial of service on embedded BACnet devices.

The vulnerability affects the open‑source BACnet Stack project (identified as bacnet-stack:bacnet-stack) in all releases earlier than 1.4.3. Any deployment that has enabled the ReadPropertyMultiple confirmed service handler – enabled by default in the reference server – is potentially exposed.

The flaw carries a CVSS score of 8.7, indicating a high severity impact. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited active exploitation. Attackers can exploit the weakness remotely over the BACnet/IP network without authentication, sending a crafted message to trigger the overflow. Successful exploitation would allow an attacker to read memory contents beyond the buffer or to crash the stack, potentially interrupting critical building automation systems.