Executive Summary

CVE-2026-26264 is a vulnerability in the BACnet Stack, an open source protocol stack C library used in embedded systems. The issue occurs when decoding a malformed WriteProperty request. Specifically, in the function wp_decode_service_request, the code calculates a length parameter as apdu_len - apdu_size without verifying that apdu_size is less than or equal to apdu_len. If a truncated or malformed APDU is processed, this subtraction underflows, resulting in a very large length value.

This causes an out-of-bounds read in memory, which can lead to a crash of the BACnet service, resulting in a denial of service (DoS). The root cause is a lack of proper validation of length fields during decoding, leading to CWE-125 (Out-of-bounds Read). The vulnerability was fixed by adding proper length underflow checks in the decoding functions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the BACnet service to crash when it processes a malformed WriteProperty request. An attacker can exploit this by sending a specially crafted truncated APDU to the vulnerable BACnet service, triggering an out-of-bounds read and causing the process to become unstable or crash.

The impact is a denial of service (DoS), which means the affected system or device running the BACnet stack may become unavailable or stop functioning correctly until it is restarted or patched.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or denial of service conditions in BACnet stack services when they receive malformed or truncated WriteProperty requests.

A proof-of-concept (PoC) was created using GCC with address sanitizer enabled to detect memory errors related to this vulnerability.

Detection involves sending malformed or truncated WriteProperty APDU packets to the BACnet service and observing if the service crashes or behaves unexpectedly.

• Use network packet crafting tools (e.g., Scapy) to send malformed WriteProperty APDU requests targeting the BACnet service.
• Run the BACnet stack binary under a memory error detector such as AddressSanitizer to catch out-of-bounds reads.
• Monitor system logs and service stability for crashes or denial of service symptoms after sending suspicious packets.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the BACnet stack to a patched version that fixes this vulnerability.

• Upgrade to BACnet stack version 1.5.0rc4 or later, or 1.4.3rc2 or later, where the length underflow checks have been properly secured.
• If upgrading is not immediately possible, consider implementing network-level filtering to block malformed or truncated WriteProperty APDU requests.
• Monitor BACnet services for crashes and restart them promptly to reduce downtime.

Useful 0 Not Useful 0