CVE-2026-26264: Bacnetstack Bacnet Stack

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.

Affected products

• Bacnetstack Bacnet Stack: from 1.4.0, before 1.4.3 (fixed in 1.4.3); version 1.4.3 only; version 1.5.0 only

Published 2026-02-13. Last modified 2026-06-17.