CVE-2026-47710: BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-buffer-overflow can be triggered in the current master branch when a Loop object reads a referenced property through its default timer path and the referenced property is OBJECTSTRUCTUREDVIEW / PROPDESCRIPTION containing a long attacker-controlled string. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using BACnet Stack versions earlier than 1.4.4, 1.5.1, or 1.6.0 are affected when a Loop object can read a referenced Structured View object's Description property through its default timer path.
What must an attacker control to trigger the overflow?
The attacker needs to cause the Loop object to reference OBJECT_STRUCTURED_VIEW / PROP_DESCRIPTION containing a long attacker-controlled string. The vector is network-accessible and requires no privileges or user interaction.
Are default settings implicated?
Yes. The vulnerable read occurs through the Loop object's default timer path, so the affected behavior does not depend on a non-default timer configuration.
What versions contain the fix?
The issue is patched in BACnet Stack versions 1.4.4, 1.5.1, and 1.6.0. Upgrade to the applicable fixed release line.