bacnet-stack vulnerabilities and threats

A NULL pointer dereference vulnerability exists in bacnet-stack versions 1.4.0 to before 1.4.4 and 1.5.0 to before 1.5.1. The flaw occurs in the function bacnet_device_object_reference_decode() when processing a WriteProperty request that updates OBJECT_STRUCTURED_VIEW / PROP_SUBORDINATE_LIST. This can lead to a denial of service due to application crash. The issue has been fixed in versions 1.4.4 and 1.5.1.

A stack-based buffer overflow vulnerability exists in bacnet-stack prior to versions 1.4.4 and 1.5.1. The flaw occurs when the server processes a malicious Atomic-Read-File request with an excessively large RecordCount, causing out-of-bounds writes on the stack. This can lead to a stack-buffer-overflow due to improper bounds checking on a stack-allocated data structure. The issue has been fixed in versions 1.4.4 and 1.5.1.

CVE-2026-52786 is a high-severity vulnerability in the bacnet-stack open source BACnet protocol library. It affects the official apps/epics client tool prior to versions 1.4.5, 1.5.1, and 1.6.0. A malicious BACnet/IP endpoint can send a crafted ReadPropertyMultiple-ACK response containing more properties than the tool's fixed local storage can handle. This leads to a global buffer overflow in the response processing code, causing memory corruption. The issue arises from improper validation of array indices when processing variable-length property lists. The vulnerability has been patched in the stated fixed versions.

An out-of-bounds read vulnerability exists in bacnet-stack versions 1.4.0 up to but not including 1.4.3. The flaw occurs in the ReadPropertyMultiple service property decoder, where a specially crafted BACnet/IP packet with a truncated property list can cause the decoder to read beyond allocated buffer boundaries. This can lead to crashes on embedded BACnet devices. The vulnerability is fixed in version 1.4.3.

An out-of-bounds read vulnerability (CWE-125) exists in bacnet-stack versions 1.4.0 up to but not including 1.4.3. The flaw occurs in the ReadPropertyMultiple service decoder where a crafted request with a truncated object identifier causes the code to read one byte beyond the allocated buffer. This can lead to crashes on embedded BACnet devices. The issue is fixed in version 1.4.3.

An out-of-bounds read vulnerability exists in bacnet-stack versions 1.4.0 up to but not including 1.4.3. The flaw occurs in the WritePropertyMultiple service decoder due to improper bounds checking in a deprecated function, allowing unauthenticated remote attackers to read beyond allocated buffer boundaries by sending a truncated request. This can lead to crashes or information disclosure on embedded BACnet devices. The issue is fixed in version 1.4.3.

CVE-2026-40279 is a vulnerability in the bacnet-stack open source BACnet protocol library for embedded systems. Versions prior to 1.4.3 contain a flaw in the decode_signed32() function, which reconstructs a 32-bit signed integer from four bytes using signed left shifts. When any byte has its highest bit set (≥ 0x80), this causes signed integer overflow, which is undefined behavior according to the C standard. This issue is fixed in version 1.4.3.