High 7.8Published Feb 13, 2026

CVE-2026-26264BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash

Updated under an hour ago (Oct 27, 2026, 4:40 AM ET)

Does this affect you?

It affects bacnet-stack and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for bacnet-stack

Exploited in the last 30 days

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wp_decode_service_request. When decoding the optional priority context tag, the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode without validating that apdu_size <= apdu_len. If a truncated APDU reaches this path, apdu_len - apdu_size underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.

CVSS: 7.8 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Feb 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

bacnet-stack bacnet-stack bacnet_stack:bacnet_stack (from the name)	from 1.5.0rc1, < 1.5.0rc4; before 1.4.3rc2	CNA record
bacnetstack bacnet_stack bacnetstack:bacnet_stack	from 1.4.0 before 1.4.3; 1.4.3; 1.5.0; 1.5.0; 1.5.0	NVD

References

References

https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-phjh-v45p-gmjj	x-refsource-confirm, exploit, vendor-advisory
https://github.com/bacnet-stack/bacnet-stack/commit/4cc8067c86f26e2b08b2c8f4d27f8e07de4d4708	x-refsource-misc, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.