Out-of-Bounds Read Vulnerability in bacnet_stack Affects Network Protocol Operations
CVE-2026-38570

7.5HIGH

Key Information:

Vendor

bacnet-stack

Status
bacnet_stack
Vendor
CVE Published:
4 June 2026

What is CVE-2026-38570?

The bacnet_stack version 1.3.1 has a vulnerability in its bacnet_tag_number_decode function that allows for an out-of-bounds read. This flaw can be exploited by attackers to execute specially crafted inputs, potentially leading to a denial of service condition. When the function processes unexpected data, it may read beyond the allocated memory, resulting in application instability or crashes.

References

https://github.com/bacnet-stack/bacnet-stack
https://github.com/bacnet-stack/bacnet-stack/issues/1270

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.