CVE Intelligence
Analysis AI-assisted

CVE-2026-41475: BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder

BACnet Stack builds from 1.4.0 before 1.4.3 contain an out-of-bounds read in the WritePropertyMultiple decoder, which the record describes as reachable remotely without authentication. The flaw can cause crashes or information disclosure on embedded BACnet devices, and the record reports a fix in 1.4.3. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

BACnet Stack is an open source C library implementing the BACnet protocol for embedded systems. According to the record, builds before 1.4.3 have an out-of-bounds read in the WritePropertyMultiple service decoder. The flaw comes from a deprecated tag parsing function that does not check the input buffer length. The vendor's advisory is GHSA-cvv4-v3g6-4jmv.

Impact

  • The record describes reads of 1 to 7 bytes past the end of the buffer when a truncated property payload is received.
  • The stated consequences are crashes or information disclosure on embedded BACnet devices.
  • The NVD vector indicates high confidentiality and availability impact with no integrity impact. GitHub assigns a CVSS score of 8.7, and NVD assigns 9.1.

Affected products and versions

  • Product: Bacnetstack Bacnet Stack.
  • The affected list in the record covers builds from 1.4.0 up to before 1.4.3, and the release candidates 1.5.0-rc1, 1.5.0-rc2 and 1.5.0-rc3.
  • The record states the fix is in 1.4.3.
  • The description refers to versions prior to 1.4.3, while the affected list also names the release candidates. Check your exact build against the vendor advisory.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by KEV.
  • No confirmed exploitation appears in the sources consulted.
  • The record's SSVC data lists exploitation as poc (proof of concept). This is a signal about available proof-of-concept material, not confirmed attacks.
  • The EPSS probability in the record is 0.0067 with a percentile of 0.51429.

Remediation and mitigation

  • Upgrade BACnet Stack deployments to 1.4.3 or later, as the record indicates.
  • Confirm whether the release candidates listed as 1.5.0-rc1 through 1.5.0-rc3 are covered by the fix. The record does not settle this.
  • Until patching is possible, limit BACnet/IP exposure to trusted networks and isolate building or industrial control networks from untrusted segments.
  • The fix entry in the record is typed as mitigation, and the record does not describe the code change.

Detection guidance

  • Review logs and network telemetry for malformed or unusually short BACnet/IP requests reaching devices.
  • Watch for unexpected restarts, resets or crashes of BACnet devices, which may indicate failed parsing.
  • Track which devices run BACnet Stack and which firmware or build version they use.

Limitations of the available information

  • The record does not include a fix diff, a full timeline, or a vendor-tested list of affected devices.
  • It does not say which downstream products embed this library.
  • Whether the release candidates are affected in the same way is unknown from the record.

Frequently asked questions

Is this vulnerability known to be exploited in the wild?

No. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC data lists a proof-of-concept level, which is not the same as confirmed attacks.

Which version fixes the issue?

The record states the vulnerability is fixed in 1.4.3. Builds from 1.4.0 up to before 1.4.3 are listed as affected.

Who should prioritize this?

Operators of embedded BACnet devices running affected BACnet Stack builds, especially where BACnet traffic can arrive from untrusted networks. The record describes remote access without authentication.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.