CVE-2026-41475— BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41475
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
Source: NVD (National Vulnerability Database)
Vulnerability Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存读
Source: NVD (National Vulnerability Database)
Vulnerability Title
BACnet Stack 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
BACnet Stack是BACnet Stack开源的一个适用于嵌入式系统、Linux、MacOS、BSD 和 Windows 的 BACnet 开源协议栈 C 库。 BACnet Stack 1.4.3之前版本存在缓冲区错误漏洞，该漏洞源于bacnet-stack的WritePropertyMultiple服务解码器中的越界读取漏洞，允许未经身份验证的远程攻击者通过发送截断的WPM请求读取超出分配缓冲区边界的数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bacnet-stack | bacnet-stack | >= 1.4.0, < 1.4.3 | - |
II. Public POCs for CVE-2026-41475
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41475
请登录查看更多情报信息。
Same Patch Batch · bacnet-stack · 2026-04-24 · 3 CVEs total
| CVE-2026-41503 | BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated T | |
| CVE-2026-41502 | BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder |
IV. Related Vulnerabilities
Same product: bacnet-stack
- CVE-2026-41503
BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Pro - CVE-2026-41502
BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyM - CVE-2026-40279
BACnet Stack: Undefined-behavior signed left shift in `decod - CVE-2026-26264
BACnet Stack WriteProperty decoding length underflow leads t - CVE-2026-21878
BACnet Stack Improperly Limits Pathnames to a Restricted Dir
Same vendor: bacnet-stack
- CVE-2026-41503
BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Pro - CVE-2026-41502
BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyM - CVE-2026-40279
BACnet Stack: Undefined-behavior signed left shift in `decod - CVE-2026-26264
BACnet Stack WriteProperty decoding length underflow leads t - CVE-2026-21878
BACnet Stack Improperly Limits Pathnames to a Restricted Dir
Same weakness: CWE-125
- CVE-2026-8177
XML::LibXML versions through 2.0210 for Perl read out-of-bou - CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attack - CVE-2026-7258
Out-of-bounds read in urldecode() on NetBSD - CVE-2026-8186
Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out- - CVE-2026-3508
ASUS System Control Interface 缓冲区错误漏洞
V. Comments for CVE-2026-41475
No comments yet