A vulnerability in the BACnet Stack library prior to versions 1.4.5, 1.5.1, and 1.6.0 allows a malformed but non-empty BACnet WriteProperty request to cause an infinite processing loop. This leads to uncontrolled resource consumption and a denial of service condition on the official server demo. The issue has been addressed in the specified fixed versions.
CVE-2026-62973 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw exists in the official BACnet client application 'readpropm' prior to versions 1.4.5, 1.5.1, and 1.6.0. A malicious BACnet/IP peer can send a malformed but structurally valid ReadPropertyMultiple-ACK response that triggers a global buffer overflow read on the client's receive buffer. This vulnerability has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-62972 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The issue occurs in the lighting_command_decode function where nested decoders read beyond the intended buffer boundary due to inconsistent size parameters. This flaw was fixed in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-58265 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw occurs in the BACnet/SC header-option decoder where a BACnet/SC peer can trigger a heap read of up to 3 bytes before authentication. This happens because the function bvlc_sc_decode_proprietary_option() reads fixed offsets without verifying the option's declared header length, and the option-list validator does not enforce a minimum length for proprietary options. The issue has been fixed in versions 1.4.5, 1.5.1, and 1.6.0.
A remote out-of-bounds write vulnerability (CWE-787) exists in the official router-ipv6 application of the bacnet-stack library prior to versions 1.4.5, 1.5.1, and 1.6.0. This flaw allows an attacker to write beyond the bounds of a global transmit buffer, potentially leading to denial of service or other impacts. The issue has been patched in the specified fixed versions.
A use-after-free vulnerability exists in the bacnet-stack open source BACnet protocol library prior to versions 1.4.5, 1.5.1, and 1.6.0. This memory safety issue can be triggered via BACnet/IP using the official sample server, leading to a stack-use-after-return condition in writable Device string properties. The flaw has been addressed in the specified fixed versions.
A denial of service vulnerability exists in the BACnet Stack open source protocol library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the ReadPropertyMultiple handler can enter an infinite loop when processing a malformed request packet missing expected closing tags. This flaw has been patched in the specified fixed versions.
CVE-2026-52788 is a high-severity vulnerability in the bacnet-stack open source BACnet protocol library for embedded systems. The flaw exists in the bsc_node_parse_urls() function, which improperly handles space-separated WebSocket URIs from BACnet/SC Address Resolution ACK messages. This leads to out-of-bounds writes beyond the bounds of a fixed-size array, potentially causing memory corruption. The issue affects versions prior to 1.4.5, 1.5.1, and 1.6.0 and has been fixed in these releases.
CVE-2026-52787 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. It involves an incorrect calculation of buffer size leading to a reachable out-of-bounds write when encoding the device.address-binding property. This flaw affects versions prior to 1.4.5, 1.5.1, and 1.6.0-rc2. The issue has been fixed in these versions.
CVE-2026-49990 is a high-severity vulnerability in the bacnet-stack open source BACnet protocol library for embedded systems. Versions 1.4.2 up to but not including 1.4.5, and 1.5.0 up to but not including 1.5.1, improperly validate a signed fileStartPosition parameter in AtomicReadFile and AtomicWriteFile stream-access requests. This leads to out-of-bounds reads and writes in RAM file backends, potentially causing process crashes, memory exposure, or heap corruption. The issue is fixed in versions 1.4.5 and 1.5.1.
A denial-of-service vulnerability exists in bacnet-stack prior to version 1.5.1. The flaw affects the default demo server built from the unmodified apps/server/main.c and allows remote attackers to cause uncontrolled resource consumption. This issue has been addressed in version 1.5.1.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
A stack-based buffer overflow vulnerability exists in the bacnet-stack open source BACnet protocol library for embedded systems. Versions prior to 1.4.4, 1.5.1, and 1.6.0 are affected. The flaw occurs when a Loop object reads a referenced property through its default timer path, specifically if the referenced property is OBJECT_STRUCTURED_VIEW or PROP_DESCRIPTION containing a long attacker-controlled string. This vulnerability has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
A stack-based buffer overflow vulnerability exists in the bacnet-stack library prior to versions 1.4.4, 1.5.1, and 1.6.0. The flaw occurs when a RemoveListElement request targeting Notification-Class.recipient-list contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements, leading to an out-of-bounds write on the stack. This issue has been fixed in the specified versions.
A stack-based out-of-bounds write vulnerability exists in the BACnet Stack open source protocol library prior to versions 1.4.4, 1.5.1, and 1.6.0. The flaw occurs in the Notification Class object implementation when handling the AddListElement operation for the recipient-list property. This vulnerability has been addressed in the specified fixed versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKUP_RESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0.
A vulnerability in the BACnet Stack open source protocol library prior to versions 1.4.4 and 1.5.1 allows a remote attacker to cause uncontrolled recursion and a stack overflow by abusing the Channel object in the default server application. This can result in a denial of service due to application crash. The issue has been fixed in versions 1.4.4 and 1.5.1.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1.
A use of uninitialized variable vulnerability exists in the bacnet-stack library versions 1.4.0 to before 1.4.4 and 1.5.0 to before 1.5.1. The flaw occurs in the AtomicReadFile record-access ACK encoder, allowing unauthenticated remote attackers to corrupt encoded OCTET STRING length and payload boundaries by sending crafted requests. This vulnerability has been fixed in versions 1.4.4 and 1.5.1.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1.