Skip to content
OpenAdvisories
High · 8.6 CVE-2026-58498 EUVD-2026-125536

BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path

Published Nov 13, 2026 · Assigned by GitHub_M

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

Affected products

VendorProductAffectedFixed
bacnet-stack bacnet-stack < 1.4.5, < 1.5.1, < 1.6.0 —

References