CVE-2026-64675: BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xycolordecode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.5 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using the BACnet Stack C library with BACnet/IP reachable over UDP port 47808 are exposed if they run a version earlier than 1.4.5 or 1.5.1. The affected paths are default-registered service handlers, so no special service registration is required.
What does an attacker need to exploit it?
An attacker only needs network access to send a single BACnet/IP UDP datagram to port 47808. Authentication, prior privileges, and user interaction are not required.
Which protocol requests can reach the vulnerable code?
The out-of-bounds read is reachable through the unconfirmed WriteGroup service (service 0x0A) and through a confirmed WriteProperty request targeting a BACnetXYColor-typed property.
How can this be remediated?
Upgrade to a patched release: 1.4.5, 1.5.1, or 1.6.0. If an immediate upgrade is not possible, limit network access to BACnet/IP UDP port 47808 to trusted BACnet peers.
How can I determine whether a system is affected?
Check whether the application includes BACnet Stack and identify its version. Versions prior to 1.4.5 and 1.5.1 are affected; systems not exposed through BACnet/IP UDP port 47808 are not remotely reachable through the described vector.