PT-2026-8020 · Unknown · Bacnet Stack

Ho-9 · Published 2026-02-13 · Updated 2026-02-13 · CVE-2026-26264

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BACnet Stack versions prior to 1.5.0rc4 BACnet Stack versions prior to 1.4.3rc2

Description BACnet Stack is a BACnet open source protocol stack C library for embedded systems. A crafted WriteProperty request can cause a length underflow in the BACnet stack, resulting in an out-of-bounds read and a denial-of-service (DoS) condition. The issue resides in the wp decode service request function within the wp.c file. Specifically, the bacnet unsigned context decode function receives an incorrect size calculation (apdu len - apdu size) due to a missing validation check where apdu size is greater than apdu len, leading to the out-of-bounds read.

Recommendations Update to BACnet Stack version 1.5.0rc4 or later. Update to BACnet Stack version 1.4.3rc2 or later.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-26264

GHSA-PHJH-V45P-GMJJ

Affected Products

Bacnet Stack

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26264.json · Exploit
• 🔥 https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-phjh-v45p-gmjj · Exploit
• https://github.com/bacnet-stack/bacnet-stack/commit/4cc8067c86f26e2b08b2c8f4d27f8e07de4d4708 · Patch
• https://osv.dev/vulnerability/CVE-2026-26264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26264 · Security Note
• https://twitter.com/VulmonFeeds/status/2022394502124614065 · Twitter Post
• https://twitter.com/CVEnew/status/2022387980506403128 · Twitter Post
• https://t.me/CVEtracker/44646 · Telegram Post