EUVD-2026-34310
GHSA-572j-c8jf-p9vv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial of service.
AnalysisAI
Denial of service in BACnet Stack 1.3.1 occurs through an out-of-bounds read in the bacnet_tag_number_decode function, allowing remote attackers to crash affected building automation systems by sending crafted BACnet protocol messages. No public exploit identified at time of analysis, and EPSS scores the exploitation probability at a very low 0.02%, though the network-reachable nature of BACnet deployments in critical infrastructure warrants attention.
Technical ContextAI
BACnet Stack is an open-source implementation of the Building Automation and Control Networks (BACnet) protocol (ASHRAE/ANSI 135, ISO 16484-5), widely deployed in HVAC, lighting, access control, and other building management systems. The vulnerability sits in bacnet_tag_number_decode, a parsing routine responsible for decoding the application-layer tag numbers that prefix every BACnet APDU data element. CWE-125 (Out-of-bounds Read) indicates the function reads memory past the boundary of an input buffer - typically due to missing length checks when a malformed or truncated tag header is processed - which can dereference unmapped memory and crash the process handling BACnet/IP (UDP/47808) or BACnet/MSTP traffic.
RemediationAI
No vendor-released patch identified at time of analysis; the only references are the upstream repository and tracking issue https://github.com/bacnet-stack/bacnet-stack/issues/1270, so operators should monitor that issue for a fixed release and pull the upstream commit once merged. As compensating controls, restrict BACnet/IP (UDP/47808) and BACnet/MSTP traffic to trusted management VLANs and block it at the perimeter - BACnet should never be Internet-exposed; place a BACnet-aware firewall or BBMD that drops malformed APDUs in front of vulnerable devices, accepting that legitimate cross-subnet BACnet discovery may need explicit allowlisting. Where a device crash would disrupt life-safety or HVAC operations, plan for watchdog-driven auto-restart or process supervision so a single malformed packet does not produce sustained outage, and rate-limit unsolicited BACnet messages at the network edge.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today