CVE-2026-26264: BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-13 · updated 2026-06-17
Weakness: CWE-125

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.

Affected products

bacnet-stack: from 1.4.0 before 1.4.3; 1.4.3-rc1, 1.5.0-rc1, 1.5.0-rc2, 1.5.0-rc3 — fixed in 1.4.3

How to fix

Upgrade to a fixed version: bacnet-stack 1.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-26264 or the next vulnerability affects your stack