Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-41502: BACnet Stack may expose memory via ReadPropertyMultiple

CVE-2026-41502 · published 6 months ago

Summary

The open‑source BACnet Stack library used in embedded controllers can be tricked into reading one byte beyond its allocated memory when it processes a specially crafted ReadPropertyMultiple request. This could cause the device to crash or reveal internal data to an unauthenticated attacker. Update the library to version 1.4.3 or later, or disable the ReadPropertyMultiple service if it is not needed.

What to do

Update bacnetstack bacnet_stack to version 1.4.3 or later.

Affected software

Vendor	Product	Affected versions
bacnetstack	bacnet_stack	>= 1.4.0, < 1.4.3 1.5.0 `cpe:2.3:a:bacnetstack:bacnet_stack::::::::`

Original advisory text

BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service decoder allows unauthenticated remote attackers to read one byte past an allocated buffer boundary by sending a crafted RPM request with a truncated object identifier. The vulnerability is in rpm_decode_object_id(), which checks apdu_len < 5 but then accesses all 6 byte positions (indices 0-5) — consuming 1 byte for the context tag, 4 bytes for the object ID, then reading apdu[5] for the opening tag check. A 5-byte input passes the length check but causes a 1-byte OOB read, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.

References

https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7545-3fpx-... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41502... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41502 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

CWE-193Off-by-one Error

Timeline

Published24 Apr 2026

Updated4 Nov 2026

First seen24 Apr 2026

Sources

CVE-2026-41502 · NVD

CVE-2026-41502 · OSV

GHSA-7545-3fpx-4xw3 · GHSA

Track software like this

Free during beta