PT-2026-35078 · Unknown · Bacnet Stack

Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-41503

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BACnet Stack versions prior to 1.4.3

Description An out-of-bounds read exists in the ReadPropertyMultiple service property decoder. Unauthenticated remote attackers can read past allocated buffer boundaries by sending a ReadPropertyMultiple request with a truncated property list. This occurs because the rpm decode object property() function calls the deprecated decode tag number and value() function, which does not accept a buffer length parameter and reads blindly from the provided pointer. A crafted BACnet/IP packet containing a 1-byte property payload with an extended tag marker (0xF9) can cause the decoder to read 1 byte past the end of the buffer, potentially leading to crashes on embedded devices. This issue affects deployments that enable the ReadPropertyMultiple confirmed service handler, which is enabled by default in the reference server.

Recommendations Update to version 1.4.3. As a temporary workaround, disable the ReadPropertyMultiple confirmed service handler to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-41503

Affected Products

Bacnet Stack

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41503 · Security Note
• https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-5w2v-mwqj-pr2c · Note
• https://twitter.com/VulmonFeeds/status/2047846538370514954 · Twitter Post
• https://twitter.com/CVEnew/status/2047798557860888815 · Twitter Post