CVE-2026-40279 BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`

What is CVE-2026-40279?

CVE-2026-40279 is a low-severity vulnerability in bacnet-stack, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3.

Weakness: CWE-758

Which versions are affected by CVE-2026-40279?

It affects 1 product.

Products include Bacnetstack Bacnet Stack.

How do I fix CVE-2026-40279?

No fix has been published for CVE-2026-40279 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-40279 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40279 exists.

Other vulnerabilities in bacnet-stack

• CVE-2023-51773 Memory corruption in n/a Critical 9.1
• CVE-2026-41475 BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser High 8.7
• CVE-2026-41502 BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder High 8.7
• CVE-2026-41503 BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser High 8.7
• CVE-2026-26264 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-326g-j95f-gmxv.