CVE-2026-26264

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0rc4 and 1.4.3rc2, a malformed WriteProperty request can trigger a length underflow in the BACnet stack, leading to an out‑of‑bounds read and a crash (DoS). The issue is in wp.c within wpdecodeservicerequest. When decoding the optional priority context tag, the code passes apdulen - apdusize to bacnetunsignedcontextdecode without validating that apdusize <= apdulen. If a truncated APDU reaches this path, apdulen - apdusize underflows, resulting in a large size being used for decoding and an out‑of‑bounds read. This vulnerability is fixed in 1.5.0rc4 and 1.4.3rc2.