CVE-2026-26264 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
A malformed BACnet WriteProperty request causes an integer underflow leading to an out-of-bounds read and crash, requiring an upgrade to the BACnet Stack library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26264?
CVE-2026-26264 is a high-severity vulnerability in bacnet-stack, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.
Weakness: CWE-125
Which versions are affected by CVE-2026-26264?
It affects 1 product.
Products include Bacnetstack Bacnet Stack.
How do I fix CVE-2026-26264?
No fix has been published for CVE-2026-26264 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-26264 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26264 exists.
Other vulnerabilities in bacnet-stack
- CVE-2023-51773 Memory corruption in n/a
- CVE-2026-41475 BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
- CVE-2026-41502 BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
- CVE-2026-41503 BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
- CVE-2026-21878 BACnet Stack Improperly Limits Pathnames to a Restricted Directory
Sources
Also known as GHSA-phjh-v45p-gmjj.