CVE-2026-26264: BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wpdecodeservicerequest. When decoding the optional priority context tag, the code passes apdulen - apdusize to bacnetunsignedcontextdecode without validating that apdusize <= apdulen. If a truncated APDU reaches this path, apdulen - apdusize underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26264?
CVE-2026-26264 is classified as a critical vulnerability due to its potential to cause crashes and compromises in embedded systems.
How do I fix CVE-2026-26264?
To fix CVE-2026-26264, upgrade to BACnet Stack version 1.5.0rc4 or later version 1.4.3rc2.
What type of vulnerability is CVE-2026-26264?
CVE-2026-26264 is a decoding length underflow vulnerability in the BACnet Stack that can lead to out-of-bounds reads.
Who is affected by CVE-2026-26264?
CVE-2026-26264 affects users running BACnet Stack versions prior to 1.5.0rc4 and 1.4.3rc2.
What can exploit CVE-2026-26264?
CVE-2026-26264 can be exploited through malformed WriteProperty requests sent to the BACnet stack.