CVE-2026-52786: BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.5 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the official apps/epics client tool in BACnet Stack versions before 1.4.5, 1.5.1, and 1.6.0. It is specifically in the EPICS tool’s response-processing path, not the generic BACnet ReadPropertyMultiple ACK decoder alone.
What does an attacker need to exploit this?
A malicious BACnet/IP endpoint must be able to send a crafted but syntactically valid ReadPropertyMultiple-ACK in response to the EPICS tool’s legitimate ReadPropertyMultiple request. No attacker privileges are required, but the user must initiate the request.
How can this be remediated?
Upgrade BACnet Stack to version 1.4.5, 1.5.1, or 1.6.0, depending on the release line in use. These versions include the fix.
What can be done before upgrading?
Avoid using the official EPICS client tool against untrusted or potentially malicious BACnet/IP endpoints. Restrict network access so that only trusted BACnet/IP devices can respond to the tool’s requests.