CVE-2026-41502 BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
Unauthenticated remote attackers can cause crashes or read memory by sending crafted BACnet ReadPropertyMultiple requests to devices using the vulnerable library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41502?
CVE-2026-41502 is a high-severity memory corruption vulnerability in bacnet-stack, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service decoder allows unauthenticated remote attackers to read one byte past an allocated buffer boundary by sending a crafted RPM request with a truncated object identifier. The vulnerability is in rpm_decode_object_id(), which checks apdu_len < 5 but then accesses all 6 byte positions (indices 0-5) — consuming 1 byte for the context tag, 4 bytes for the object ID, then reading apdu[5] for the opening tag check. A 5-byte input passes the length check but causes a 1-byte OOB read, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.
Which versions are affected by CVE-2026-41502?
It affects 1 product.
Products include Bacnetstack Bacnet Stack.
How do I fix CVE-2026-41502?
No fix has been published for CVE-2026-41502 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-41502 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41502 exists.
Other vulnerabilities in bacnet-stack
- CVE-2023-51773 Memory corruption in n/a
- CVE-2026-41475 BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
- CVE-2026-41503 BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
- CVE-2026-26264 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
- CVE-2026-21878 BACnet Stack Improperly Limits Pathnames to a Restricted Directory
Sources
Also known as GHSA-7545-3fpx-4xw3.