Vulnerability Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bacnetstack | Bacnet Stack | >= 1.4.0, < 1.4.3 |
Related Weaknesses (CWE)
References
- https://github.com/bacnet-stack/bacnet-stack/commit/4cc8067c86f26e2b08b2c8f4d27fPatch
- https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-phjh-v45p-Vendor AdvisoryExploit
FAQ
What is CVE-2026-26264?
CVE-2026-26264 is a vulnerability with a CVSS score of 8.1 (HIGH). BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack...
How severe is CVE-2026-26264?
CVE-2026-26264 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26264?
Check the references section above for vendor advisories and patch information. Affected products include: Bacnetstack Bacnet Stack.