CVE-2026-40279

OVERVIEW CVE-2026-40279 is an undefined behavior vulnerability in BACnet Stack versions prior to 1.4.3, affecting the decode_signed32() function in src/bacnet/bacint.c. The flaw occurs when reconstructing 32-bit signed integers from APDU bytes through signed left-shift operations on bytes with bit 7 set (values ≥ 0x80), violating C standard compliance. This vulnerability impacts any embedded systems running vulnerable versions of the BACnet open source protocol stack library that process signed-integer property values containing high-bit-set bytes. SEVERITY The vulnerability carries a CVSS 3.1 score of 3.7 (LOW) with a network-based attack vector requiring high complexity, no privileges, and no user interaction. The impact is limited to low-severity availability degradation, with no confidentiality or integrity compromise. The EPSS score of 0.00033 indicates minimal real-world exploitation likelihood compared to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains on the inactive hotlist. While UndefinedBehaviorSanitizer flags this behavior thousands of times per minute on affected inputs, indicating detection capability, no public exploit code or active community attack campaigns have been documented. The issue was resolved in BACnet Stack version 1.4.3.