Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.
INFO
Published Date :
2026-02-13T18:14:30.232Z
Last Modified :
2026-02-13T18:50:30.367Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-26264 vulnerability.
| Vendors | Products |
|---|---|
| Bacnetstack |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-26264.
