Which versions of BACnet Stack are affected by CVE-2026-41502?

CVE-2026-41502 is a remote denial-of-service vulnerability in BACnet Stack library (versions before 1.4.3) that allows unauthenticated attackers to crash building automation devices through malformed…. A patch is available.

How to fix or mitigate CVE-2026-41502?

Within 24 hours: Inventory all BACnet devices and applications in your environment and confirm library versions (focus on building automation systems, HVAC controllers, and fire safety devices). Within 7 days: Contact BACnet device manufacturers to confirm patch availability timelines and interim mitigation options; implement network segmentation to restrict BACnet traffic to trusted administrative networks only. Within 30 days: Deploy BACnet Stack library version 1.4.3 or later to all affected devices as patches become available from vendors, prioritizing critical building safety systems.

BACnet Stack CVE-2026-41502

Q: What is the CVSS score of CVE-2026-41502?

CVE-2026-41502 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25624 HIGH

Out-of-bounds Read (CWE-125)

2026-04-24 GitHub_M

Buffer Overflow Information Disclosure Bacnet Stack

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 28, 2026 - 15:35 nvd

Patch available

Re-analysis Queued

Apr 25, 2026 - 03:22 vuln.today

cvss_changed

Patch available

Apr 24, 2026 - 21:02 EUVD

Analysis Generated

Apr 24, 2026 - 20:31 vuln.today

CVSS changed

Apr 24, 2026 - 20:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 20:15 euvd

EUVD-2026-25624

Analysis Generated

Apr 24, 2026 - 20:15 vuln.today

CVE Published

Apr 24, 2026 - 19:40 nvd

HIGH 8.7

DescriptionGitHub Advisory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service decoder allows unauthenticated remote attackers to read one byte past an allocated buffer boundary by sending a crafted RPM request with a truncated object identifier. The vulnerability is in rpm_decode_object_id(), which checks apdu_len < 5 but then accesses all 6 byte positions (indices 0-5) - consuming 1 byte for the context tag, 4 bytes for the object ID, then reading apdu[5] for the opening tag check. A 5-byte input passes the length check but causes a 1-byte OOB read, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.

AnalysisAI

Remote denial of service in BACnet Stack library versions before 1.4.3 allows unauthenticated attackers to crash embedded building automation devices by sending a malformed ReadPropertyMultiple request with a truncated object identifier. The off-by-one buffer read vulnerability triggers crashes on resource-constrained BACnet devices running the default-enabled RPM service handler. CVSS v4.0 scores this 8.7 (High) based on network attack vector and high availability impact, though no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

BACnet (Building Automation and Control Networks) is an ASHRAE/ANSI/ISO standard protocol widely deployed in building management systems for HVAC, lighting, and access control. The bacnet-stack library provides an open-source C implementation targeting embedded systems. The vulnerability resides in the rpm_decode_object_id() function within src/bacnet/rpm.c, which handles ReadPropertyMultiple (RPM) service requests. The function implements insufficient bounds checking: it validates apdu_len < 5 but subsequently accesses array indices 0-5 (six bytes total), creating a classic off-by-one error classified as CWE-125 (Out-of-bounds Read). When processing the context tag (1 byte), object identifier (4 bytes), and opening tag validation (apdu[5]), a crafted 5-byte input passes validation but triggers a one-byte read beyond the allocated buffer boundary, exposing adjacent memory contents or causing segmentation faults on memory-protected systems.

RemediationAI

Upgrade BACnet Stack library to version 1.4.3 or later, which contains the vendor-released fix for the rpm_decode_object_id() bounds checking logic. The patch is available through the project's GitHub repository at https://github.com/bacnet-stack/bacnet-stack with details in security advisory GHSA-7545-3fpx-4xw3. For embedded systems requiring extensive validation cycles before firmware updates, implement compensating controls: disable the ReadPropertyMultiple service handler if RPM functionality is not operationally required (modify service handler registration in application code), or deploy network segmentation to restrict BACnet/IP traffic (UDP port 47808) to trusted building automation network segments only using firewalls or VLANs. Note that disabling RPM may break building management system integrations relying on bulk property reads for efficiency. Network filtering reduces attack surface but does not prevent exploitation from compromised devices within the trusted zone. Organizations using vendor-supplied BACnet devices should contact manufacturers to obtain firmware updates incorporating the bacnet-stack 1.4.3 library fix.