CVE-2026-49341: BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow

Q: Which deployments are exposed to this issue?

The affected deployment identified is the default demo server built from the unmodified apps/server/main.c in BACnet Stack versions before 1.5.1. The issue is remotely reachable.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network access with low attack complexity, no privileges required, and no user interaction.

Q: What is the practical impact of successful exploitation?

Successful exploitation can cause a server stack overflow and remotely deny service. The provided impact assessment identifies availability impact only, with no confidentiality or integrity impact.

Q: What should be done to remediate the issue?

Upgrade BACnet Stack to version 1.5.1, which includes the patch. The provided information does not specify a workaround for deployments that cannot yet upgrade.

Published Nov 13, 2026

Updated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, there is a remotely reachable denial-of-service vulnerability in bacnet-stack affecting the default demo server built from the unmodified apps/server/main.c. This issue has been patched in version 1.5.1.

Affected Software

1 affected component

BACnet Stack<1.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1

Event History

Nov 13, 2026

CVE Published

via MITRE·03:53 PM

Data Sourced

via MITRE·03:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected deployment identified is the default demo server built from the unmodified apps/server/main.c in BACnet Stack versions before 1.5.1. The issue is remotely reachable.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network access with low attack complexity, no privileges required, and no user interaction.

What is the practical impact of successful exploitation?

Successful exploitation can cause a server stack overflow and remotely deny service. The provided impact assessment identifies availability impact only, with no confidentiality or integrity impact.

What should be done to remediate the issue?

Upgrade BACnet Stack to version 1.5.1, which includes the patch. The provided information does not specify a workaround for deployments that cannot yet upgrade.

CVE-2026-49341: BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the practical impact of successful exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the practical impact of successful exploitation?

What should be done to remediate the issue?