CVE-2026-40279
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3.
Scoring
- Severity
- LOW
- CVSS base score
- 3.7
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS probability
- 0.24%
- CWE
- CWE-758
- Published
- 2026-04-21
- Last modified
- 2026-04-21
Affected products
- bacnet-stack bacnet-stack
Weakness type
Related vulnerabilities
- CVE-2026-16441 — Eclipse OpenJ9 : Method resolution default method precedence failure
- CVE-2026-50185 — RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
- CVE-2024-58350 — Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order
- CVE-2026-34549 — iccDEV: UB at IccUtil.cpp
- CVE-2026-34547 — iccDEV: UB at IccUtil.cpp
- CVE-2026-34537 — iccDEV: UB in CIccOpDefEnvVar::Exec()
- CVE-2026-34533 — iccDEV: UB in CIccCalculatorFunc::ApplySequence()
- CVE-2026-28528 — BlueKitchen BTstack < 1.8.1 AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB Read / Undefined Behavior