CVE-2026-40279: BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decodesigned32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40279?
CVE-2026-40279 has not been assigned a specific severity rating, but it involves undefined behavior that could lead to vulnerabilities in the BACnet Stack.
How do I fix CVE-2026-40279?
To address CVE-2026-40279, update the BACnet Stack to version 1.4.3 or later.
What systems are affected by CVE-2026-40279?
CVE-2026-40279 affects all versions of the BACnet Stack prior to version 1.4.3.
What is the impact of CVE-2026-40279?
The impact of CVE-2026-40279 includes potential integer exploitation due to signed left shift operations, which can result in undefined behavior.
What is the BACnet Stack?
The BACnet Stack is an open-source protocol stack designed for embedded systems that implement the BACnet protocol.