CVE-2026-41475: BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpmdecodeobjectproperty() calling the deprecated decodetagnumberandvalue() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41475?
CVE-2026-41475 has been classified as a medium severity vulnerability due to its potential to cause Denial of Service or information disclosure.
How do I fix CVE-2026-41475?
To fix CVE-2026-41475, update your BACnet Stack to version 1.4.3 or later.
What causes CVE-2026-41475?
CVE-2026-41475 is caused by an out-of-bounds read vulnerability in the WritePropertyMultiple service decoder in BACnet Stack.
Who is affected by CVE-2026-41475?
CVE-2026-41475 affects users of BACnet Stack versions prior to 1.4.3.
What is the impact of CVE-2026-41475?
The impact of CVE-2026-41475 includes potential exposure to improper access to memory, leading to unintended behavior in applications using BACnet Stack.