bacnet-stack up to 1.5.0.rc1 BACnet Protocol src/bacnet/npdu.c bacnet_npdu_decode out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in bacnet-stack up to 1.5.0.rc1. This affects the function bacnet_npdu_decode of the file src/bacnet/npdu.c of the component BACnet Protocol Handler. Executing a manipulation can lead to out-of-bounds. This vulnerability is registered as CVE-2025-66624. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in bacnet-stack up to 1.5.0.rc1. This vulnerability affects the function bacnet_npdu_decode of the file src/bacnet/npdu.c of the component BACnet Protocol Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. CVE summarizes:

BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior to 1.5.0.rc2, The npdu_is_expected_reply function in src/bacnet/npdu.c indexes request_pdu[offset+2/3/5] and reply_pdu[offset+1/2/4] without verifying that those APDU bytes exist. bacnet_npdu_decode() can return offset == 2 for a 2-byte NPDU, so tiny PDUs pass the version check and then get read out of bounds. On ASan/MPU/strict builds this is an immediate crash (DoS). On unprotected builds it is undefined behavior and can mis-route replies; RCE is unlikely because only reads occur, but DoS is reliable.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-66624 since 12/05/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.5.0.rc2 eliminates this vulnerability. Applying the patch 9378f7d1e70169ebde4a5090bae7603703eadf48 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• bacnet-stack

Version

• 1.5.0.rc1

License

• open-source

Website

• Product: https://github.com/bacnet-stack/bacnet-stack/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion