CVE-2026-41503 BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
Unauthenticated remote attackers can cause crashes or read memory via out-of-bounds read in BACnet Stack's ReadPropertyMultiple decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41503?
CVE-2026-41503 is a high-severity memory corruption vulnerability in bacnet-stack, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service property decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending an RPM request with a truncated property list. The vulnerability stems from rpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function at src/bacnet/rpm.c:344, which accepts no buffer length parameter and reads blindly from whatever pointer it receives. A crafted BACnet/IP packet with a 1-byte property payload containing an extended tag marker (0xF9) causes the decoder to read 1 byte past the end of the buffer, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.
Weakness: CWE-125
Which versions are affected by CVE-2026-41503?
It affects 1 product.
Products include Bacnetstack Bacnet Stack.
How do I fix CVE-2026-41503?
No fix has been published for CVE-2026-41503 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-41503 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41503 exists.
Other vulnerabilities in bacnet-stack
- CVE-2023-51773 Memory corruption in n/a
- CVE-2026-41475 BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
- CVE-2026-41502 BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
- CVE-2026-26264 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
- CVE-2026-21878 BACnet Stack Improperly Limits Pathnames to a Restricted Directory
Sources
Also known as GHSA-5w2v-mwqj-pr2c.