CVE-2026-21870: BACnet Stack Buffer Overflow Vulnerability

CVE-2026-21870 Overview

CVE-2026-21870 is an off-by-one stack-based buffer overflow vulnerability in the BACnet Protocol Stack library, which provides BACnet application layer, network layer, and media access (MAC) layer communications services. The vulnerability exists in the ubasic interpreter and causes a crash (SIGABRT) when processing string literals longer than the buffer limit. This flaw affects industrial control systems and building automation environments that rely on the BACnet Protocol Stack for communication services.

Critical Impact

An attacker who can provide malicious input to the ubasic interpreter can trigger a denial of service condition by causing the application to crash via stack buffer overflow when processing specially crafted string literals.

Affected Products

• BACnet Stack versions 1.4.2 and earlier
• BACnet Stack version 1.5.0-rc1
• BACnet Stack version 1.5.0-rc2

Discovery Timeline

• 2026-02-13 - CVE CVE-2026-21870 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-21870

Vulnerability Analysis

This vulnerability is classified as CWE-193 (Off-by-one Error), a common programming mistake that occurs when boundary conditions are incorrectly calculated. The flaw resides in the tokenizer_string function within src/bacnet/basic/program/ubasic/tokenizer.c, which is responsible for processing string tokens in the ubasic interpreter.

The vulnerability is exploitable through local access and requires user interaction, such as loading a malicious BACnet program file. When successfully triggered, the overflow corrupts the stack, leading to an immediate application crash. While the vulnerability does not allow for code execution or data exfiltration in its current form, the denial of service impact could be significant in industrial control system environments where continuous operation is critical.

Root Cause

The root cause is an incorrect boundary check in the tokenizer_string function. The code fails to properly account for null termination when copying maximum-length strings. When a string literal reaches exactly the buffer limit (40 characters), the function writes a null byte to dest[40] while the buffer only has valid indices from 0 to 39. This one-byte overflow past the allocated buffer boundary corrupts adjacent stack memory, triggering stack protection mechanisms and causing a SIGABRT signal.

Attack Vector

The attack vector requires local access with user interaction. An attacker would need to craft a malicious input file or program containing a string literal of exactly the maximum buffer length. When the ubasic interpreter processes this input, the off-by-one error causes a write operation one byte past the buffer boundary. The exploitation scenario involves:

1. Crafting a BACnet program with a string literal of maximum length (40 characters)
2. Having the target system load and process the malicious program
3. The tokenizer_string function copies the string and attempts to null-terminate it
4. The null byte is written to an out-of-bounds memory location, corrupting the stack
5. Stack smashing protection detects the corruption and aborts the program

The following patch addresses the vulnerability by correcting the boundary check:

     } while (*(string_end - 1) == '\\');
 
     string_len = string_end - tree->ptr - 1;
-    if (len < string_len) {
-        string_len = len;
+    if (string_len > len - 1) {
+        /* space for null terminator */
+        string_len = len - 1;
     }
     memcpy(dest, tree->ptr + 1, string_len);
     dest[string_len] = 0;

Source: GitHub Commit 4e11763

Detection Methods for CVE-2026-21870

Indicators of Compromise

• Unexpected SIGABRT signals or application crashes in BACnet stack processes
• Core dumps indicating stack smashing detected in tokenizer_string or related ubasic functions
• Log entries showing abnormal termination of BACnet services when processing program files

Detection Strategies

• Monitor for unexpected crashes or restarts of BACnet-enabled applications and services
• Implement file integrity monitoring on BACnet program files to detect potentially malicious modifications
• Use application crash analysis tools to identify stack overflow patterns in ubasic interpreter components
• Deploy SentinelOne agents to detect and alert on anomalous process terminations in industrial control environments

Monitoring Recommendations

• Enable stack trace logging for BACnet applications to capture detailed information during crashes
• Configure alerting for repeated service restarts that may indicate exploitation attempts
• Monitor system logs for stack buffer overflow detections and SIGABRT signals

How to Mitigate CVE-2026-21870

Immediate Actions Required

• Identify all systems running affected BACnet Stack versions (1.4.2, 1.5.0-rc1, 1.5.0-rc2, and earlier)
• Apply the security patch from the official repository as soon as possible
• Restrict access to BACnet program file loading functionality to trusted administrators only
• Implement input validation for any user-supplied program files before processing

Patch Information

The vulnerability has been addressed through a patch available in the official BACnet Stack repository. The fix modifies the boundary check in tokenizer_string to properly reserve space for null termination by checking string_len > len - 1 instead of len < string_len. Organizations should update to a patched version by applying commit 4e1176394a5ae50d2fd0b5790d9bff806dc08465 or by pulling the changes from Pull Request #1196. For detailed information, refer to the GitHub Security Advisory GHSA-pc83-wp6w-93mx.

Workarounds

• Disable or restrict access to the ubasic interpreter functionality if not required for operations
• Implement network segmentation to isolate BACnet-enabled systems from untrusted sources
• Validate and sanitize all input files before processing by the BACnet stack

# Configuration example - Compile with stack protection enabled
gcc -fstack-protector-strong -o bacnet_app bacnet_app.c -lbacnet
# Ensure ASLR is enabled on the system
echo 2 > /proc/sys/kernel/randomize_va_space