CVE-2026-41475: Bacnet Deprecated Decode Tag Number And Value Oob Read
Use of the deprecated decode_tag_number_and_value() function detected. This helper accepts no apdu_size parameter and performs NO bounds checking on the input buffer. It unconditionally reads apdu[0] (and apdu[1] for the extended-tag form) which causes 1-7 byte out-of-bounds reads when the caller-supplied buffer is truncated (CVE-2026-41475). Use the bounds-
greprules fetch cve-2026-41475-bacnet-deprecated-decode-tag-number-and-value-oob-read --engine opengrepDescription
Use of the deprecated decode_tag_number_and_value() function detected. This helper accepts no apdu_size parameter and performs NO bounds checking on the input buffer. It unconditionally reads apdu[0] (and apdu[1] for the extended-tag form) which causes 1-7 byte out-of-bounds reads when the caller-supplied buffer is truncated (CVE-2026-41475). Use the bounds-
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.