Which versions of BACnet Stack are affected by CVE-2026-41503?

CVE-2026-41503 affects BACnet Stack library versions prior to 1.4.3, enabling remote attackers to crash building automation control systems through malformed network requests without authentication.. A patch is available.

How to fix or mitigate CVE-2026-41503?

Within 24 hours: Identify all BACnet Stack deployments and confirm library versions in use via vendor documentation or firmware analysis; disable ReadPropertyMultiple service if operationally feasible as interim protection. Within 7 days: Contact your BACnet Stack vendor or system integrator for patch availability confirmation and upgrade timeline; implement network segmentation to restrict BACnet traffic to trusted engineering subnets only. Within 30 days: Apply vendor-released patch to version 1.4.3 or later across all affected devices; validate post-patch stability through staged deployment on non-critical systems first.

BACnet Stack CVE-2026-41503

Q: What is the CVSS score of CVE-2026-41503?

CVE-2026-41503 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25625 HIGH

Out-of-bounds Read (CWE-125)

2026-04-24 GitHub_M

Buffer Overflow Information Disclosure Bacnet Stack

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 28, 2026 - 15:30 nvd

Patch available

Re-analysis Queued

Apr 27, 2026 - 14:22 vuln.today

cvss_changed

Patch available

Apr 24, 2026 - 21:02 EUVD

Analysis Generated

Apr 24, 2026 - 20:31 vuln.today

CVSS changed

Apr 24, 2026 - 20:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 20:15 euvd

EUVD-2026-25625

Analysis Generated

Apr 24, 2026 - 20:15 vuln.today

CVE Published

Apr 24, 2026 - 19:41 nvd

HIGH 8.7

DescriptionGitHub Advisory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service property decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending an RPM request with a truncated property list. The vulnerability stems from rpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function at src/bacnet/rpm.c:344, which accepts no buffer length parameter and reads blindly from whatever pointer it receives. A crafted BACnet/IP packet with a 1-byte property payload containing an extended tag marker (0xF9) causes the decoder to read 1 byte past the end of the buffer, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.

AnalysisAI

Remote attackers can crash BACnet Stack-powered embedded devices (versions prior to 1.4.3) by sending malformed ReadPropertyMultiple (RPM) requests containing a 1-byte property payload with an extended tag marker (0xF9). The vulnerability triggers an out-of-bounds read in the RPM service decoder, causing denial-of-service on industrial building automation systems that use this open-source C library. Affects default configurations where ReadPropertyMultiple service is enabled. EPSS data and KEV status not available; no public exploit confirmed at time of analysis, though GitHub security advisory provides technical details that could facilitate reproduction.

Technical ContextAI

BACnet Stack is an open-source C library implementing the BACnet protocol (Building Automation and Control Networks, ISO 16484-5) for embedded systems in HVAC, lighting, and industrial control environments. The vulnerability resides in the ReadPropertyMultiple (RPM) service handler, which allows clients to retrieve multiple properties from BACnet objects in a single request. The flaw occurs in rpm_decode_object_property() at src/bacnet/rpm.c:344, where the deprecated decode_tag_number_and_value() function is called without buffer boundary validation. This function lacks a length parameter and performs blind pointer dereferencing. When processing Application Protocol Data Units (APDUs), a specially crafted packet with a truncated property list containing the extended tag marker byte 0xF9 causes the decoder to read beyond the allocated buffer boundary. The root cause maps to CWE-125 (Out-of-bounds Read), a memory safety issue common in C codebases that lack bounds checking on buffer operations. The BACnet/IP transport layer (UDP port 47808 by default) allows remote network access to this service handler.

RemediationAI

Upgrade BACnet Stack library to version 1.4.3 or later, which replaces the deprecated decode_tag_number_and_value() function with bounds-checked alternatives in the RPM property decoder. The GitHub security advisory at https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-5w2v-mwqj-pr2c confirms version 1.4.3 as the patched release. For systems unable to immediately upgrade due to embedded firmware constraints or vendor qualification cycles, implement network-level compensating controls: (1) Restrict BACnet/IP traffic (UDP port 47808) to only trusted building automation network segments using firewalls or VLANs-this prevents remote internet-based exploitation but does not protect against lateral movement within BMS networks; (2) Deploy BACnet/IP routers with packet inspection capabilities to filter malformed RPM requests, though this requires deep protocol knowledge and may introduce latency in time-sensitive control loops; (3) If RPM service is not operationally required, disable the ReadPropertyMultiple confirmed service handler in application configuration-verify this does not break existing building automation workflows that depend on multi-property queries. Note that network segmentation alone does not prevent exploitation by compromised devices within the same automation zone.