Skip to content
OpenAdvisories
High · 7.5 CVE-2026-52787 EUVD-2026-125532

BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()

Published Nov 13, 2026 · Assigned by GitHub_M

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2.

Affected products

VendorProductAffectedFixed
bacnet-stack bacnet-stack < 1.4.5, < 1.5.1, < 1.6.0-rc2 —

References