CVE-2026-40279: low-severity vulnerability in bacnet-stack
BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.2%
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
bacnet-stack · bacnet-stackRelated CVEs — bacnet-stack
In the same product, most dangerous first.
CVE-2026-41475HIGHBACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag ParserEPSS 0.5%CVE-2025-66624HIGHBACnet-stack MS/TP reply matcher OOB readEPSS 0.4%CVE-2026-26264HIGHBACnet Stack WriteProperty decoding length underflow leads to OOB read and crashEPSS 0.4%CVE-2026-41503HIGHBACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag ParserEPSS 0.4%CVE-2026-21878HIGHBACnet Stack Improperly Limits Pathnames to a Restricted DirectoryEPSS 0.4%CVE-2026-41502HIGHBACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID DecoderEPSS 0.4%