CVE-2026-38570: bacnet_stack 1

Synopsis

An out-of-bounds read vulnerability exists in bacnet_stack 1.3.1, specifically in the bacnet_tag_number_decode function. The flaw is reachable over the network without any authentication or user interaction, based on the CVSS vector (AV:N/PR:N/UI:N). Successful exploitation allows an attacker to crash the affected service, causing a denial of service. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network, meaning an attacker must be able to send crafted BACnet packets to the target service to trigger the out-of-bounds read.

• AuthenticationNot required

  No credentials or prior authentication are needed; the attacker can reach the vulnerable code as an unauthenticated network peer.

• Victim interactionNot required

  No user action is required; the attacker triggers the vulnerability entirely by sending malformed input to the service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental factors to succeed.

Blast Radius

• The affected service process crashes upon receiving a maliciously crafted BACnet message, interrupting all BACnet communication handled by that process.
• Any connected device or system relying on the bacnet_stack service for real-time communication loses its link until the service is restarted.
• Repeated exploitation can sustain a denial-of-service condition indefinitely, preventing recovery without network-level filtering or process supervision.