CVE-2026-47711: BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are exposed?
The affected deployment described is the current master demo server running over BACnet/IP. The vulnerable path involves loop-1 and life-safety-zone-1, which are part of that default demo-server configuration.
What does an attacker need to do to trigger the issue?
An unauthenticated remote attacker needs network access to the BACnet/IP service and must send a valid Confirmed WriteProperty request. The request updates loop-1's controlled-variable-reference to life-safety-zone-1 / accepted-modes.
What is the practical impact of successful exploitation?
The demo server can be crashed remotely, creating a denial-of-service condition. The provided data does not establish code execution or impacts beyond the crash.
Which versions contain the fix?
The issue is patched in versions 1.4.4, 1.5.1, and 1.6.0. Versions prior to those releases are affected according to the advisory.