CVE-2026-41475 is a critical out-of-bounds read (CVSS 9.1) in BACnet Stack, the C library for embedded building automation devices. A truncated WritePropertyMultiple request makes the decoder read past a buffer. Fixed in 1.4.3 and 1.5.0.
What's affected
The GitHub advisory lists affected versions as 1.5.0.rc1 and 1.4.0 through 1.4.2, with 1.5.0 and 1.4.3 as patched. The advisory says the WritePropertyMultiple confirmed service handler is enabled by default in the reference server.
Since BACnet Stack is embedded in firmware, you may be running it without knowing, inside a building controller or gateway.
How to check if you're exposed
For code you build, check the library version in your source tree or submodule. For devices, ask the manufacturer whether their firmware uses BACnet Stack and which version. The advisory describes a decoder, wpm_decode_object_property(), that calls a deprecated function with no bounds checking, so your code is affected if it uses that decoder from an affected version.
Then see whether BACnet/IP traffic can reach those devices from untrusted networks.
What to do now
- Upgrade BACnet Stack to 1.4.3 or 1.5.0, and rebuild and redeploy firmware.
- Ask device vendors for firmware that includes the fix.
- Keep building automation networks off the internet and segmented from office networks.
- Allow BACnet/IP traffic only from known controllers and workstations.
Why it matters
The record lists CWE-125, out-of-bounds read. The advisory says the read goes 1 to 7 bytes past the end of the buffer, which can crash a device or leak data.
On embedded devices, a crash can mean a controller going offline until it restarts, which matters for physical systems. The advisory also notes that a recent commit replaced deprecated decoders in one layer but left many service decoders untouched, a reminder to finish a hardening migration. The record does not flag this CVE as known exploited.
Quick check
Our vendor ships BACnet firmware. How do we know if it is affected?
Ask the vendor if their stack is based on BACnet Stack 1.4.0 to 1.4.2 or 1.5.0.rc1, and when a fixed build ships.
Sources
Last reviewed: 19 October 2026.
