CVE-2026-41475

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated WPM request. The vulnerability stems from wpm_decode_object_property() calling the deprecated decode_tag_number_and_value() function, which performs no bounds checking on the input buffer. A crafted BACnet/IP packet with a truncated property payload causes the decoder to read 1-7 bytes past the end of the buffer, leading to crashes or information disclosure on embedded BACnet devices. This vulnerability is fixed in 1.4.3.

• CWE-125

• https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmvExploit, Mitigation, Vendor Advisory
• https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmvExploit, Mitigation, Vendor Advisory

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41469Beghelli Sicuro24 SicuroWeb does not enforce a Content Secur…5.2
• CVE-2026-4147An authenticated user with the read role may read limited am…4.3
• CVE-2026-41470LIVE555 before 2026.04.22 contains an authorization bypass v…8.2
• CVE-2026-41471The Easy PayPal Events & Tickets plugin for WordPress before…8.2
• CVE-2026-41472CyberPanel versions prior to 2.4.5 contain a stored cross-si…6.1
• CVE-2026-41473CyberPanel versions prior to 2.4.5 contain an authentication…9.1
• CVE-2026-41476Deskflow is a keyboard and mouse sharing app. Prior to 1.26…8.8
• CVE-2026-41477Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.…7.8
• CVE-2026-41478Saltcorn is an extensible, open source, no-code database app…9.9
• CVE-2026-41479Authlib is a Python library which builds OAuth and OpenID Co…5.4
• CVE-2026-4148A use-after-free vulnerability can be triggered in sharded c…8.8
• CVE-2026-41481LangChain is a framework for building agents and LLM-powered…6.5