Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser · Advisory · bacnet-stack/bacnet-stack · GitHub

Vulnerability Overview Vulnerability Name: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser Vulnerability Description: Type: Out-of-Bounds Read Impact: Allows an unauthenticated remote attacker to read memory beyond the allocated buffer boundary by sending an RPM request with a truncated property list. Trigger Condition: When the deprecated function is called within , it accepts no buffer length parameter and blindly reads. Specific Details: Using a 1-byte property payload containing the extended tag marker causes the decoder to read 1 byte beyond the end of the buffer, leading to crashes on embedded BACnet devices. Affected Scope Affected Versions: 1.5.0.rc1, 1.4.0–1.4.2 Fixed Versions: 1.5.0, 1.4.3 CVSS Score: 8.7 / 10 Attack Vector: Network Attack Complexity: Low Attack Requirements: None Privileges Required: None User Interaction: None System Impact: - Confidentiality: None - Integrity: None - Availability: High Subsequent System Impact: - Confidentiality: None - Integrity: None - Availability: None Remediation Recommended Fix: Replace the deprecated call with , which includes bounds checking. Specific Code Changes: Related PR: PR 1244 POC Code Verification Evidence Test Environment: macOS Darwin 25.1.0 Test Time: February 23, 2026 Test Version: bacnet-stack 1.5.0 (master branch, commit ) ASAN Output: Impact Unauthorized Remote Vulnerability: An attacker can trigger an out-of-bounds read by sending a crafted ReadPropertyMultiple packet. Device Crash: May cause BACnet devices to crash. Service Disruption: ReadPropertyMultiple is one of the most commonly used BACnet services for monitoring device status. This vulnerability may lead to service interruption. References CVE-125: Out-of-Bounds Read Commit STAR507: Partially fixed deprecated decoders in the BVL layer PR 1244: Secure ReadPropertyMultiple code — only fixed the decoder and encoder, but did not touch the request property decoder PR 1254: Secure WPM and RPM service decoders — only fixed the request property decoder BACnet Standard Clause 15.7: ReadPropertyMultiple Service

Goal Reached Thanks to every supporter — we hit 100%!

Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser · Advisory · bacnet-stack/bacnet-stack · GitHub

More from this source