CVE-2026-26264
📋 TL;DR
A length underflow vulnerability in the BACnet Stack library allows attackers to cause denial-of-service through malformed WriteProperty requests. This affects embedded systems using vulnerable versions of the BACnet protocol stack. The vulnerability can be triggered remotely by sending specially crafted BACnet packets.
💻 Affected Systems
- BACnet Stack library
📦 What is this software?
Bacnet Stack by Bacnetstack
Bacnet Stack by Bacnetstack
Bacnet Stack by Bacnetstack
Bacnet Stack by Bacnetstack
Bacnet Stack by Bacnetstack
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash leading to denial-of-service for BACnet-dependent building automation systems, potentially affecting HVAC, lighting, or access control systems.
Likely Case
Service disruption causing temporary unavailability of BACnet services until system restart.
If Mitigated
Minimal impact with proper network segmentation and input validation in place.
🎯 Exploit Status
Exploitation requires crafting malformed BACnet WriteProperty requests but does not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0rc4 or 1.4.3rc2
Vendor Advisory: https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-phjh-v45p-gmjj
Restart Required: No
Instructions:
1. Update BACnet Stack library to version 1.5.0rc4 or 1.4.3rc2. 2. Recompile any applications using the library. 3. Deploy updated applications to affected systems.
🔧 Temporary Workarounds
Network segmentation
allIsolate BACnet networks from untrusted networks using firewalls or VLANs.
Input validation
allImplement additional APDU validation at network perimeter or application layer.
🧯 If You Can't Patch
- Implement strict network access controls to limit BACnet traffic to trusted sources only.
- Deploy network intrusion detection systems to monitor for malformed BACnet packets.
🔍 How to Verify
Check if Vulnerable:
Check BACnet Stack library version in use. If version is earlier than 1.5.0rc4 or 1.4.3rc2, the system is vulnerable.Check Version:
Check library version through application documentation or build configuration files.Verify Fix Applied:
Verify BACnet Stack library version is 1.5.0rc4 or 1.4.3rc2 or later.📡 Detection & Monitoring
Log Indicators:
- Application crashes
- BACnet service restarts
- Memory access violation errors
Network Indicators:
- Malformed BACnet WriteProperty requests
- Unusual BACnet traffic patterns
SIEM Query:
BACnet protocol anomalies OR application crashes with BACnet stack references