Out-of-Bounds Read Vulnerability in BACnet Stack Library from BACnet

CVE-2026-64675

What is CVE-2026-64675?

The BACnet Stack, an open-source BACnet protocol stack C library for embedded systems, is affected by a vulnerability that allows an unauthenticated BACnet/IP UDP datagram to trigger an out-of-bounds read. This takes place through the xy_color_decode() function, which can be accessed pre-authentication via two default-registered service handlers. This flaw has been addressed in versions 1.4.5, 1.5.1, and 1.6.0, ensuring that users of these versions are protected against the exploit.

References