CVE-2026-47259: BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NCMAXRECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using BACnet Stack versions earlier than 1.4.4, 1.5.1, or 1.6.0 are affected if they process RemoveListElement requests targeting Notification-Class.recipient-list.
What does an attacker need to send to trigger the overflow?
An attacker must send a RemoveListElement request for Notification-Class.recipient-list containing more than NC_MAX_RECIPIENTS valid BACnetDestination elements. The provided vector indicates network access is sufficient and no privileges or user interaction are required.
How can I remediate the issue?
Upgrade to BACnet Stack 1.4.4, 1.5.1, or 1.6.0. These versions contain the patch for the recipient-list decoding overflow.