CVE-2026-45341

Name of the Vulnerable Software and Affected Versions BACnet Stack versions 1.4.0 through 1.4.3 BACnet Stack versions 1.5.0

Description A NULL pointer dereference can be triggered in the bacnet device object reference decode() function when a WriteProperty request updates OBJECT STRUCTURED VIEW / PROP SUBORDINATE LIST. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to a system crash.

Recommendations Update BACnet Stack versions 1.4.0 through 1.4.3 to version 1.4.4. Update BACnet Stack version 1.5.0 to version 1.5.1.