BACnet Stack CVE-2026-41502

Vulnerability requires the ReadPropertyMultiple (RPM) confirmed service handler to be enabled in the BACnet Stack application-this is the default configuration in bacnet-stack reference server implementations. Exploitation succeeds against any device with network-reachable BACnet/IP services (UDP port 47808) running library versions before 1.4.3. No authentication, special user interaction, or non-default configuration is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N), making this exploitable against default deployments. Exploitation is limited to denial of service impact-the one-byte out-of-bounds read does not facilitate code execution or privilege escalation on typical embedded platforms with memory protection. Devices must be processing BACnet protocol requests to be vulnerable; systems with RPM service explicitly disabled at the application layer are not affected.

Real-world risk assessment reveals moderate priority despite the high CVSS score. The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with low complexity, and the VA:H rating reflects the severe availability impact on embedded devices. However, several factors mitigate urgency: the vulnerability only causes a one-byte out-of-bounds read leading to denial of service rather than remote code execution (VC:N/VI:N indicates no confidentiality or integrity impact); no CISA KEV listing exists; no EPSS score is provided but absence of public weaponization suggests low observed exploitation; the affected service must be explicitly enabled (though it is default-enabled in reference implementations). The primary concern is operational disruption to critical building infrastructure-crashed BACnet devices can disable HVAC, fire systems, or physical access controls. Organizations using bacnet-stack in production embedded systems should prioritize patching, while those using vendor-supplied BACnet devices should verify firmware incorporates the fix. The confined blast radius (single-byte read) reduces likelihood of chaining with other vulnerabilities, but repeated exploitation could enable persistent availability attacks against building automation networks.

An attacker on the building automation network or with routable access to BACnet/IP services sends a specially crafted ReadPropertyMultiple request to an embedded BACnet controller running vulnerable bacnet-stack library code. The malicious packet contains a truncated 5-byte object identifier sequence that bypasses the apdu_len validation check but triggers an out-of-bounds read when rpm_decode_object_id() accesses the sixth byte position. On memory-protected embedded systems, this causes an immediate segmentation fault and device crash, requiring manual reboot and disrupting HVAC control, lighting automation, or access control functions managed by the affected controller.