CVE-2026-41502 Details
Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an off-by-one out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service decoder allows unauthenticated remote attackers to read one byte past an allocated buffer boundary by sending a crafted RPM request with a truncated object identifier. The vulnerability is in rpm_decode_object_id(), which checks apdu_len < 5 but then accesses all 6 byte positions (indices 0-5) — consuming 1 byte for the context tag, 4 bytes for the object ID, then reading apdu[5] for the opening tag check. A 5-byte input passes the length check but causes a 1-byte OOB read, leading to crashes on embedded BACnet devices. The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server). This vulnerability is fixed in 1.4.3.
An off-by-one out-of-bounds read vulnerability has been identified in BACnet Stack versions 1.5.0.rc1 and 1.4.0 prior to 1.4.3. This vulnerability resides in the ReadPropertyMultiple service decoder, specifically within the 'rpm_decode_object_id()' function. The issue allows unauthenticated remote attackers to read one byte beyond an allocated buffer by sending a crafted ReadPropertyMultiple request with a truncated object identifier. The vulnerability occurs because the function checks if the APDU length is less than 5 but then accesses all 6 byte positions, leading to a crash on embedded BACnet devices. The vulnerability affects any deployment that enables the ReadPropertyMultiple confirmed service handler, which is enabled by default in the reference server.
Users can upgrade to BACnet Stack versions 1.5.0 or 1.4.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7545-3fpx-4xw3 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7545-3fpx-4xw3 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-193 | Off-by-one Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bacnetstack bacnet stack | >= 1.4.0, < 1.4.3 1.5.0 rc1 1.5.0 rc2 1.5.0 rc3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 25, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |