A vulnerability categorized as problematic has been discovered in bacnet-stack up to 1.4.2/1.5.0.rc2. The affected element is the function
tokenizer_string of the file src/bacnet/basic/program/ubasic/tokenizer.c. Executing a manipulation can lead to off-by-one.
The identification of this vulnerability is CVE-2026-21870. The attack can only be executed locally. There is no exploit available.
It is best practice to apply a patch to resolve this issue.
