Skip to content
OpenAdvisories
High · 7.5 CVE-2026-52790 EUVD-2026-125535

BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties

Published Nov 13, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

Affected products

VendorProductAffectedFixed
bacnet-stack bacnet-stack < 1.4.5, < 1.5.1, < 1.6.0 —

References