Skip to content
OpenAdvisories
High · 8.6 CVE-2026-47711 EUVD-2026-124672

BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server

Published Nov 12, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

Affected products

VendorProductAffectedFixed
bacnet-stack bacnet-stack < 1.4.4, < 1.5.1, < 1.6.0 —

References