What is the CVSS score of CVE-2026-40279?

CVE-2026-40279 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40279?

Yes, a patch is available for CVE-2026-40279. Update the affected software to the latest version immediately.

BACnet Stack CVE-2026-40279

EUVD-2026-24166 LOW

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior (CWE-758)

2026-04-21 GitHub_M

Buffer Overflow Bacnet Stack

3.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Apr 27, 2026 - 19:49 nvd

Patch available

Apr 21, 2026 - 18:01 EUVD

Analysis Generated

Apr 21, 2026 - 17:38 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 17:00 euvd

EUVD-2026-24166

Analysis Generated

Apr 21, 2026 - 17:00 vuln.today

CVE Published

Apr 21, 2026 - 16:29 nvd

LOW 3.7

DescriptionGitHub Advisory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3.

AnalysisAI

BACnet Stack prior to version 1.4.3 exhibits undefined behavior in the decode_signed32() function when processing signed-integer property values containing bytes with the high bit set, causing denial of service through integer overflow. Network-remote attackers can trigger this vulnerability by sending specially crafted BACnet packets with high-bit-set byte sequences, resulting in application instability or crash on embedded systems running vulnerable versions. The vulnerability is confirmed fixed in version 1.4.3.

Technical ContextAI

BACnet Stack is an open-source C library implementing the BACnet protocol for building automation and control systems on embedded platforms. The vulnerability resides in src/bacnet/bacint.c within the decode_signed32() function, which reconstructs 32-bit signed integers from four APDU (Application Protocol Data Unit) bytes using left-shift operations on signed int32_t types. When any input byte has bit 7 set (value ≥ 0x80), the signed left-shift operation on the reconstructed int32_t overflows, triggering undefined behavior under the C standard. This is a type confusion and arithmetic error (CWE-758: Speculative Execution Side Channel) issue where the unsafe bitwise manipulation of signed integers allows malformed BACnet frames to destabilize the decoder state machine. The BACnet protocol uses APDU encoding where property values encoded as signed integers with high bits set are legitimate protocol traffic.

RemediationAI

Upgrade BACnet Stack to version 1.4.3 or later, which corrects the signed integer overflow in decode_signed32(). For systems unable to immediately upgrade, implement input validation at the BACnet frame ingestion layer to reject or sanitize signed-integer property values containing bytes with the high bit set; this requires decoding APDU structure at the application level before invoking decode_signed32(), adding complexity and potential performance overhead. Alternatively, restrict BACnet communications to trusted network segments using firewall rules or network segmentation to limit the attack surface to internal building automation networks and reduce the likelihood of untrusted BACnet frames reaching vulnerable decoders. Apply the security advisory from https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv for specific patching guidance and affected version lists.