CVE-2025-66624 BACnet-stack MS/TP reply matcher OOB read
An out-of-bounds read in the BACnet stack allows attackers to cause a denial of service via malformed packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66624?
CVE-2025-66624 is a high-severity denial of service vulnerability in bacnet-stack, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior to 1.5.0.rc2, The npdu_is_expected_reply function in src/bacnet/npdu.c indexes request_pdu[offset+2/3/5] and reply_pdu[offset+1/2/4] without verifying that those APDU bytes exist. bacnet_npdu_decode() can return offset == 2 for a 2-byte NPDU, so tiny PDUs pass the version check and then get read out of bounds. On ASan/MPU/strict builds this is an immediate crash (DoS). On unprotected builds it is undefined behavior and can mis-route replies; RCE is unlikely because only reads occur, but DoS is reliable.
Weakness: CWE-125
Which versions are affected by CVE-2025-66624?
It affects 1 product.
Products include Bacnetstack Bacnet Stack.
How do I fix CVE-2025-66624?
No fix has been published for CVE-2025-66624 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-66624 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66624 exists.
Other vulnerabilities in bacnet-stack
- CVE-2023-51773 Memory corruption in n/a
- CVE-2026-41475 BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
- CVE-2026-41502 BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
- CVE-2026-41503 BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
- CVE-2026-26264 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
Sources
Also known as GHSA-8wgw-5h6x-qgqg.