CVE-2026-41502: BACnet Stack Buffer Overflow Vulnerability

CVE-2026-41502 Overview

CVE-2026-41502 is an off-by-one out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw exists in the ReadPropertyMultiple (RPM) service decoder, specifically in the rpm_decode_object_id() function within src/bacnet/rpm.c. Unauthenticated remote attackers can exploit this vulnerability by sending a crafted RPM request with a truncated object identifier, allowing them to read one byte past an allocated buffer boundary.

Critical Impact

Successful exploitation can cause denial of service through crashes on embedded BACnet devices, potentially disrupting building automation systems, HVAC controls, and other industrial control systems relying on BACnet protocol communication.

Affected Products

• BACnet Stack versions prior to 1.4.3
• BACnet Stack version 1.5.0-rc1
• BACnet Stack version 1.5.0-rc2
• BACnet Stack version 1.5.0-rc3

Discovery Timeline

• April 24, 2026 - CVE-2026-41502 published to NVD
• April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41502

Vulnerability Analysis

The vulnerability stems from an off-by-one boundary checking error in the rpm_decode_object_id() function. The function validates that apdu_len < 5 before processing input, but then proceeds to access all 6 byte positions (indices 0-5). Specifically, the decoder consumes 1 byte for the context tag, 4 bytes for the object ID, and then reads apdu[5] for the opening tag check. When a 5-byte input is supplied, it passes the length check but causes the function to read one byte beyond the allocated buffer boundary.

This vulnerability affects any deployment that enables the ReadPropertyMultiple confirmed service handler, which is enabled by default in the reference server implementation. Given that BACnet is widely used in building automation and industrial control systems, this vulnerability presents significant risk to critical infrastructure.

Root Cause

The root cause is an improper input validation error in the boundary checking logic. The length validation check (apdu_len < 5) is insufficient because the function actually requires 6 bytes of data to complete processing. This classic off-by-one error results in the code accessing memory beyond the intended buffer bounds when processing a crafted 5-byte payload.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker needs to:

1. Identify a target BACnet device running a vulnerable version of bacnet-stack
2. Craft a malicious ReadPropertyMultiple request with a truncated 5-byte object identifier
3. Send the crafted request to the BACnet UDP port (typically 47808)
4. The vulnerable decoder will attempt to read past the buffer boundary, causing undefined behavior

The attack does not require any user interaction or special privileges. Since BACnet is commonly exposed on building automation networks, devices may be accessible from internal networks or, in misconfigured environments, directly from the internet.

The vulnerability is triggered when the RPM service handler processes the malformed request. The one-byte out-of-bounds read can cause crashes on embedded devices with strict memory protection, leading to denial of service. On systems without memory protection, the behavior is undefined and may leak sensitive memory contents.

Detection Methods for CVE-2026-41502

Indicators of Compromise

• Unexpected crashes or restarts of BACnet-enabled devices
• Malformed ReadPropertyMultiple requests with truncated object identifiers (exactly 5 bytes in the APDU)
• Network traffic to UDP port 47808 containing abnormally short RPM service requests
• Core dumps or error logs indicating segmentation faults in rpm_decode_object_id() or related functions

Detection Strategies

• Deploy network intrusion detection signatures to identify malformed BACnet ReadPropertyMultiple requests with truncated payloads
• Monitor BACnet device availability and implement alerting for unexpected device restarts or communication failures
• Implement deep packet inspection for BACnet/IP traffic to validate proper APDU lengths for RPM service requests
• Review device logs for memory access violations or crash reports related to RPM service handling

Monitoring Recommendations

• Enable verbose logging on BACnet devices where supported to capture service request details
• Implement network segmentation monitoring to detect unauthorized access attempts to BACnet networks
• Deploy honeypot BACnet devices to detect reconnaissance and exploitation attempts
• Establish baseline network behavior for BACnet traffic volumes and patterns to identify anomalies

How to Mitigate CVE-2026-41502

Immediate Actions Required

• Upgrade BACnet Stack to version 1.4.3 or later immediately
• If running release candidate versions 1.5.0-rc1, 1.5.0-rc2, or 1.5.0-rc3, update to a patched version
• Implement network segmentation to isolate BACnet devices from untrusted networks
• Apply firewall rules to restrict access to BACnet UDP port 47808 to authorized systems only

Patch Information

The vulnerability is fixed in BACnet Stack version 1.4.3. Organizations should update to this version or later to remediate the vulnerability. For detailed patch information and release notes, see the GitHub Security Advisory GHSA-7545-3fpx-4xw3.

Workarounds

• Disable the ReadPropertyMultiple confirmed service handler if not required for operations (note: this may impact legitimate functionality)
• Implement network-level access controls to limit which hosts can send BACnet requests to vulnerable devices
• Deploy an application-layer firewall or proxy that can validate BACnet message structure before forwarding to backend devices
• Consider physical network isolation for critical BACnet infrastructure until patching can be completed

# Example: Restrict BACnet UDP access using iptables
# Allow BACnet traffic only from authorized building management systems
iptables -A INPUT -p udp --dport 47808 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 47808 -j DROP