A critical out-of-bounds read vulnerability in the BACnet Protocol Stack library, version 1.5.0.rc2 and earlier, permits unauthenticated remote attackers to cause a service crash.

The flaw exists within the npdu_is_expected_reply function in src/bacnet/npdu.c, where insufficient validation of APDU bytes during NPDU decoding leads to an out-of-bounds read. This vulnerability is exploitable by unauthenticated remote attackers who can send malformed packets to the target system.

The vulnerability carries a CVSS score of 7.5, classifying it as a High severity risk. A successful exploitation typically results in a denial-of-service, which can disrupt critical building automation and industrial control communications. While remote code execution is currently considered unlikely, the potential for reliable system crashes poses a significant threat to operational availability.

Immediate Action: Update the BACnet Protocol Stack library to version 1.5.0.rc2 or later to include the necessary bounds checking logic.

Proactive Monitoring: Monitor network traffic for malformed or unusually small NPDU packets that deviate from standard BACnet communication patterns.

Compensating Controls: Deploy network-level traffic filtering or an Intrusion Prevention System (IPS) to detect and block non-compliant or malformed BACnet traffic before it reaches the library.

Public Exploit Available: Unknown

Given the exposure of BACnet implementations in industrial and infrastructure environments, this vulnerability presents a notable risk to availability. Administrators should prioritize updating the library to the patched version immediately to prevent potential service disruptions caused by malicious packet injection.