CVE-2026-41503: BACnet Stack Buffer Overflow Vulnerability

CVE-2026-41503 Overview

CVE-2026-41503 is an out-of-bounds read vulnerability affecting BACnet Stack, an open source BACnet protocol stack C library designed for embedded systems. The vulnerability exists in the ReadPropertyMultiple service property decoder and allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a specially crafted RPM request with a truncated property list.

The flaw stems from the rpm_decode_object_property() function calling the deprecated decode_tag_number_and_value() function, which accepts no buffer length parameter and reads blindly from whatever pointer it receives. When a crafted BACnet/IP packet containing a 1-byte property payload with an extended tag marker (0xF9) is sent to vulnerable devices, the decoder reads 1 byte past the end of the buffer, leading to crashes on embedded BACnet devices.

Critical Impact

This vulnerability enables unauthenticated remote attackers to crash embedded BACnet devices through network-based exploitation, potentially disrupting critical building automation and industrial control systems.

Affected Products

• BACnet Stack versions prior to 1.4.3
• BACnet Stack version 1.5.0-rc1
• Any deployment enabling the ReadPropertyMultiple confirmed service handler (enabled by default in the reference server)

Discovery Timeline

• April 24, 2026 - CVE-2026-41503 published to NVD
• April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41503

Vulnerability Analysis

This out-of-bounds read vulnerability (CWE-125) affects the ReadPropertyMultiple (RPM) service implementation in BACnet Stack. The vulnerable code path is triggered when processing incoming BACnet/IP packets that contain malformed property lists in RPM requests.

The core issue lies in the use of a deprecated decoding function that performs no bounds checking. The decode_tag_number_and_value() function at src/bacnet/rpm.c:344 accepts a raw pointer without any accompanying length parameter, making it impossible for the function to verify whether sufficient data exists before reading. This architectural flaw means any truncated or malformed input can cause the decoder to read beyond the allocated buffer.

The vulnerability is particularly concerning for embedded BACnet devices, which are commonly deployed in building automation systems, HVAC controls, and industrial environments where availability is critical. A successful exploit results in a denial of service condition through device crashes.

Root Cause

The root cause is the use of the deprecated decode_tag_number_and_value() function, which was designed without security considerations for buffer boundary validation. This function blindly trusts its input pointer without verifying that sufficient bytes remain in the buffer before attempting to decode tag data.

Specifically, when a BACnet/IP packet contains only a 1-byte property payload with an extended tag marker (0xF9), the decoder interprets this as indicating additional bytes follow. Since the buffer is truncated, the subsequent read operation accesses memory beyond the allocated boundary, triggering undefined behavior that manifests as crashes on embedded systems with limited memory protection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious BACnet/IP packet targeting the ReadPropertyMultiple service
2. Including a truncated property list with a 1-byte payload containing the extended tag marker 0xF9
3. Sending the packet to any BACnet device running a vulnerable version of BACnet Stack with the RPM service handler enabled

The vulnerability exists in src/bacnet/rpm.c and affects any deployment that enables the ReadPropertyMultiple confirmed service handler, which is enabled by default in the reference server implementation. This makes the attack surface particularly broad across BACnet-enabled building automation and industrial control installations.

Detection Methods for CVE-2026-41503

Indicators of Compromise

• Unexpected crashes or restarts of BACnet-enabled embedded devices
• Malformed BACnet/IP packets targeting UDP port 47808 (standard BACnet/IP port) with truncated property payloads
• Network traffic containing extended tag markers (0xF9) in abnormally small RPM request payloads
• Repeated connection attempts followed by device failures from the same source IP

Detection Strategies

• Monitor BACnet/IP traffic for ReadPropertyMultiple requests with unusually small or malformed property lists
• Implement intrusion detection signatures for BACnet packets containing extended tag markers with insufficient payload data
• Deploy network anomaly detection to identify patterns of RPM requests followed by device unresponsiveness
• Configure alerting for devices running BACnet Stack versions prior to 1.4.3

Monitoring Recommendations

• Enable packet capture and logging on network segments containing BACnet devices
• Monitor device health metrics for unexpected restarts or communication failures
• Implement centralized logging for BACnet device events to correlate potential exploitation attempts
• Establish baselines for normal BACnet traffic patterns to identify anomalous activity

How to Mitigate CVE-2026-41503

Immediate Actions Required

• Upgrade BACnet Stack to version 1.4.3 or later immediately
• Identify all devices in your environment running vulnerable BACnet Stack versions
• Implement network segmentation to restrict access to BACnet devices from untrusted networks
• Enable firewall rules to limit BACnet/IP traffic (UDP port 47808) to authorized management systems only

Patch Information

The vulnerability is fixed in BACnet Stack version 1.4.3. Organizations should upgrade to this version or later to remediate the vulnerability. Detailed patch information and security advisory are available from the GitHub Security Advisory.

The fix addresses the unsafe buffer handling by replacing the deprecated decode_tag_number_and_value() function with a bounds-checked alternative that validates buffer length before decoding operations.

Workarounds

• Disable the ReadPropertyMultiple confirmed service handler if not required for operations
• Implement network-level access controls to restrict BACnet/IP traffic to trusted sources only
• Deploy an application-layer firewall capable of inspecting and filtering malformed BACnet packets
• Isolate vulnerable BACnet devices on segregated network segments until patching is possible

# Example: Firewall rule to restrict BACnet/IP access (iptables)
# Allow BACnet/IP only from trusted management network
iptables -A INPUT -p udp --dport 47808 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 47808 -j DROP