Buffer Overflow in BACnet Protocol Stack Library by BACnet Stack

CVE-2025-66624

What is CVE-2025-66624?

The BACnet Protocol Stack library, which offers critical communication services for BACnet applications, contains a buffer overflow vulnerability in the npdu_is_expected_reply function. This flaw arises from insufficient verification of APDU byte existence prior to indexing, potentially causing out-of-bounds reads. While this can lead to a denial-of-service condition in specific builds, it may also result in undefined behavior on unprotected builds, impairing network communications. Users are strongly advised to upgrade to version 1.5.0.rc2 or later to mitigate these risks.

References