BACnet Stack CVE-2026-40279

Attacker must be network-reachable to the BACnet Stack instance (implying BACnet service port exposure, typically UDP port 47808). The target BACnet device must process a frame containing a signed-integer APDU property with high-bit-set byte encoding (bytes ≥ 0x80 in the signed integer representation). No authentication is required and no user interaction is needed. The vulnerability is NOT triggered by all BACnet traffic-only frames carrying signed-integer properties with values that encode to bytes with bit 7 set; many BACnet installations may use unsigned integers or low-valued signed integers that do not trigger the overflow. The impact severity depends on compiler optimization level and platform architecture; production-optimized embedded binaries may exhibit silent data corruption rather than crash, while debug builds and sanitizer-instrumented builds reliably crash or warn.

CVSS 3.7 with AV:N/AC:H indicates network-remote attack vector but requires high attack complexity, suggesting non-trivial exploitation constraints. The score reflects availability impact (A:L) only-no confidentiality or integrity breach-consistent with denial of service via crash or undefined behavior. EPSS data is not provided, limiting probabilistic exploitation assessment. No KEV (CISA Known Exploited Vulnerabilities) status is indicated, and no public exploit code is referenced, suggesting this is a discovered-but-not-actively-exploited vulnerability. However, the AC:H qualifier warrants scrutiny: UndefinedBehaviorSanitizer flags this thousands of times per minute, indicating the condition is easily triggerable but the actual impact (denial of service vs. silent malfunction) depends on compiler optimization, platform architecture, and BACnet message sequence. Practical risk is moderate for always-on embedded systems in HVAC/building control where availability is critical, but low for systems with redundancy or infrequent BACnet signed-integer property queries. The vulnerability affects all versions before 1.4.3 across embedded deployments (CPE cpe:2.3:a:bacnet-stack:bacnet-stack:*) with no version constraints, meaning any legacy embedded installation is at risk until patched.

An attacker on the network sends a BACnet frame containing a signed-integer property value with bytes having bit 7 set (e.g., 0x80 or higher). The vulnerable decode_signed32() function processes this frame, triggering a signed left-shift integer overflow that violates C standard undefined behavior. On an unoptimized or debug-compiled embedded BACnet device, this may cause the decoder state machine to malfunction, crash, or hang, disrupting HVAC or building automation services until manual restart.