CVE-2026-52786

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 not in the generic BACnet RPM ACK decoder alone a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitima...

CVE-2026-47711

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-referen...

CVE-2026-47258

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been...

CVE-2026-47257

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNETBACKUPRESTORE is enabled. This issue has bee...

CVE-2026-47259

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contai...

CVE-2026-47710

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-buffer-overflow can be triggered in the current master branch when a Loop object reads a referenced property through its default timer path and the referenced...

CVE-2026-46674

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled...

CVE-2026-46677

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and...

CVE-2026-47217

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, a remote attacker can trigger an uncontrolled recursion and stack overflow in the default server application of bacnet-stack by abusing the Channel object. This issue has been...

CVE-2026-46676

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, an uninitialized value use vulnerability in bacnet-stack's AtomicReadFile record-access ACK encoder allows unauthenticated remote attackers to corrup...

CVE-2026-45341

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, a NULL pointer dereference can be triggered in bacnetdeviceobjectreferencedecode when a WriteProperty request updates OBJECTSTRUCTUREDVIEW /...

CVE-2026-45265

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug i...

CVE-2026-47711 BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-referen...

EUVD-2026-124672

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-referen...

CVE-2026-47711

The BACnet Stack , an open-source C library for embedded systems, contains a vulnerability in versions prior to 1.4.4, 1.5.1, and 1.6.0 . An attacker can remotely crash the current master demo server over BACnet/IP by sending a valid Confirmed WriteProperty request. Specifically, the request upda...

EUVD-2026-124666

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-buffer-overflow can be triggered in the current master branch when a Loop object reads a referenced property through its default timer path and the referenced...

CVE-2026-47710

The BACnet Stack , an open source BACnet protocol stack C library for embedded systems, is vulnerable to a stack-buffer-overflow in versions prior to 1.4.4, 1.5.1, and 1.6.0. The vulnerability occurs in the current master branch when a Loop object reads a referenced property via its default timer...

EUVD-2026-124665

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contai...

CVE-2026-47259

The BACnet Stack C library for embedded systems is vulnerable to a stack-based out-of-bounds write in the current master branch. This occurs when processing a RemoveListElement request targeting Notification-Class.recipient-list that contains more than NC_MAX_RECIPIENTS valid BACnetDestination el...

CVE-2026-47258

The BACnet Stack , an open source BACnet protocol stack C library for embedded systems, contains a stack-based out-of-bounds write vulnerability. This flaw exists in the Notification Class object implementation specifically when handling AddListElement for the recipient-list property . The vulner...