CVE-2026-47258: BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using BACnet Stack versions earlier than 1.4.4, 1.5.1, or 1.6.0 are affected when they handle AddListElement requests for the Notification Class recipient-list property.
What access does an attacker need to exploit this issue?
The provided vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. An attacker needs to be able to send the relevant BACnet request to the affected implementation.
What is the impact of successful exploitation?
The issue is a stack-based out-of-bounds write. The supplied severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.
What should be done to remediate the issue?
Upgrade to BACnet Stack version 1.4.4, 1.5.1, or 1.6.0, depending on the release line in use. These versions contain the patch.