CVE-2026-45341: BACnet Stack: NULL pointer dereference in bacnet_device_object_reference_decode() when WriteProperty updates Structured View subordinate-list
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, a NULL pointer dereference can be triggered in bacnetdeviceobjectreferencedecode() when a WriteProperty request updates OBJECTSTRUCTUREDVIEW / PROPSUBORDINATELIST. This issue has been patched in versions 1.4.4 and 1.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using BACnet Stack versions 1.4.0 through 1.4.3 or 1.5.0 are affected. Versions 1.4.4 and 1.5.1 contain the fix.
What must an attacker be able to do to trigger the issue?
An attacker must be able to send a BACnet WriteProperty request that updates the OBJECT_STRUCTURED_VIEW object's PROP_SUBORDINATE_LIST property. No privileges or user interaction are required according to the supplied severity vector.
What is the likely impact of successful exploitation?
The flaw causes a NULL pointer dereference, resulting in a denial of service. The supplied vector indicates high availability impact and no confidentiality or integrity impact.