Which versions of BACnet Stack are affected by CVE-2026-41475?

CVE-2026-41475 is a high-severity out-of-bounds read vulnerability in BACnet Stack library affecting building automation and industrial control systems.. A patch is available.

How to fix or mitigate CVE-2026-41475?

Within 24 hours: Identify all deployed BACnet devices and systems using BACnet Stack library versions before 1.4.3 (request asset inventory from facilities/building management teams). Within 7 days: Contact BACnet Stack vendor for confirmed patch timeline and evaluate interim network segmentation (restrict BACnet/IP to trusted administrative networks only). Within 30 days: Deploy patched BACnet Stack version 1.4.3 or later across all affected devices, prioritizing critical building systems (HVAC, fire safety, access control) and validate functionality post-patch.

BACnet Stack CVE-2026-41475

Q: What is the CVSS score of CVE-2026-41475?

CVE-2026-41475 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25621 HIGH

Out-of-bounds Read (CWE-125)

2026-04-24 GitHub_M

Buffer Overflow Information Disclosure Bacnet Stack

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 28, 2026 - 15:36 nvd

Patch available

Re-analysis Queued

Apr 27, 2026 - 14:22 vuln.today

cvss_changed

Patch available

Apr 24, 2026 - 21:02 EUVD

Analysis Generated

Apr 24, 2026 - 20:30 vuln.today

CVSS changed

Apr 24, 2026 - 20:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 20:15 euvd

EUVD-2026-25621

Analysis Generated

Apr 24, 2026 - 20:15 vuln.today

CVE Published

Apr 24, 2026 - 19:39 nvd

HIGH 8.7

DescriptionGitHub Advisory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.

AnalysisAI

Out-of-bounds read in BACnet Stack library versions before 1.4.3 allows unauthenticated remote attackers to crash embedded BACnet devices or disclose memory contents by sending malformed WritePropertyMultiple (WPM) service requests over BACnet/IP. The flaw affects building automation and industrial control systems using the vulnerable C library. No public exploit identified at time of analysis, though the CVSS v4.0 score of 8.7 reflects high availability impact and network-accessible attack surface with low complexity.

Technical ContextAI

BACnet (Building Automation and Control Networks) is an ASHRAE/ISO protocol widely deployed in HVAC, lighting, fire safety, and industrial control systems. The bacnet-stack library provides an open-source C implementation for embedded devices. The vulnerability resides in the WritePropertyMultiple (WPM) service decoder function wpm_decode_object_property(), which calls the deprecated decode_tag_number_and_value() helper. This legacy function lacks input buffer boundary validation, a classic CWE-125 out-of-bounds read condition. When processing BACnet/IP packets (UDP port 47808 by default), a truncated property payload causes the decoder to read 1-7 bytes beyond the allocated buffer, triggering undefined behavior ranging from process crashes to memory content leakage. The affected CPE indicates all versions prior to 1.4.3 across all platforms.

RemediationAI

Upgrade BACnet Stack library to version 1.4.3 or later, which replaces the deprecated decode_tag_number_and_value() function with bounds-checked parsing logic. Obtain the patched version from the official GitHub repository at https://github.com/bacnet-stack/bacnet-stack and rebuild affected applications. For systems where immediate patching is infeasible, implement network-level compensating controls: restrict BACnet/IP traffic (UDP port 47808) to trusted building automation network segments using firewall ACLs or VLANs, deploy intrusion detection signatures for malformed WPM service requests with truncated payloads, and disable WritePropertyMultiple service support if not operationally required (trade-off: loss of batch property updates, may impact building management workflows). Monitor embedded device logs for unexpected restarts or parser errors as potential exploitation indicators. Inventory all BACnet-enabled devices to identify affected library versions, as many embedded systems do not expose version information via standard interfaces.