Read the docs
TI-2026-17571 Aliases CVE-2026-21870

The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string

Priority LOW 25CWE-193Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-193 and the CVSS impact.

Summary

BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. In 1.4.2, 1.5.0.rc2, and earlier, an off-by-one stack-based buffer overflow in the ubasic interpreter causes a crash (SIGABRT) when processing string literals longer than the buffer limit. The tokenizer_string function in src/bacnet/basic/program/ubasic/tokenizer.c incorrectly handles null termination for maximum-length strings. It writes a null byte to dest[40] when the buffer size is only 40 (indices 0-39), triggering a stack overflow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bacnet-stackbacnet-stackup to 1.4.2; 1.5.0.rc1 – 1.5.0.rc2—No fix listedCNA
  • bacnet-stack Vendorbacnet-stack Affected up to 1.4.2; 1.5.0.rc1 – 1.5.0.rc2 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*up to 1.4.2Vulnerablebacnet-stack
cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:*1.5.0 rc1Vulnerablebacnet-stack
cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:*1.5.0 rc2Vulnerablebacnet-stack
  • cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:* Versions up to 1.4.2 Vulnerable ·bacnet-stack
  • cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc1:*:*:*:*:*:* Versions 1.5.0 rc1 Vulnerable ·bacnet-stack
  • cpe:2.3:a:bacnetstack:bacnet_stack:1.5.0:rc2:*:*:*:*:*:* Versions 1.5.0 rc2 Vulnerable ·bacnet-stack

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21870

References

Exploit 1

Patch 2

  • TI-2026-30089 BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser CVSS 4.0HIGH 8.7
  • TI-2026-30088 BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder CVSS 4.0HIGH 8.7
  • TI-2026-30063 BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser CVSS 4.0HIGH 8.7
  • TI-2026-21234 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash CVSS 4.0HIGH 7.8
  • TI-2026-17579 BACnet Stack Improperly Limits Pathnames to a Restricted Directory CVSS 3.1HIGH 7.5
  • TI-2025-41018 BACnet-stack MS/TP reply matcher OOB read CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences