Vulnerabilities

TI-2026-30089 CVE-2026-41503

BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser

HIGH 77

BACnet Stack is a BACnet open source protocol stack C library for embedded systems.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00415 Published 2026-04-24 Fixed in 1.4.3 CWE-125

TI-2026-30088 CVE-2026-41502

HIGH 77

BACnet Stack is a BACnet open source protocol stack C library for embedded systems.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00401 Published 2026-04-24 Fixed in 1.4.3 CWE-125

TI-2026-30063 CVE-2026-41475

HIGH 77

BACnet Stack is a BACnet open source protocol stack C library for embedded systems.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2026-04-24 Fixed in 1.4.3 CWE-125

TI-2026-29061 CVE-2026-40279

MEDIUM 51

BACnet Stack is a BACnet open source protocol stack C library for embedded systems.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00242 Published 2026-04-21 Fixed in 1.4.3 CWE-758

TI-2026-21234 CVE-2026-26264

HIGH 73

BACnet Stack is a BACnet open source protocol stack C library for embedded systems.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00427 Published 2026-02-13 Fixed in 1.5.0rc4, 1.4.3rc2 CWE-125

TI-2026-17579 CVE-2026-21878

HIGH 72

BACnet Stack is a BACnet open source protocol stack C library for embedded systems.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2026-02-13 Fixed in 1.5.0.rc3 CWE-22

TI-2026-17571 CVE-2026-21870

LOW 25

BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00278 Published 2026-02-13 No fix listed CWE-193

TI-2025-41018 CVE-2025-66624

HIGH 72

BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00443 Published 2025-12-05 Fixed in 1.5.0.rc2 CWE-125

TI-2023-28401 CVE-2023-51773 · GHSA-3j77-72gm-5rj8

MEDIUM 47

BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01053 Published 2023-12-25 No fix listed CWE-126