CVE-2026-52787: BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0-rc2
Event History
Frequently Asked Questions
Which deployments are affected?
BACnet Stack deployments using versions earlier than 1.4.5, 1.5.1, or 1.6.0-rc2 are affected. The issue is in encoding the device.address-binding property.
What access does an attacker need?
The vulnerability is reachable over the network and requires no privileges or user interaction. Exploitation has low attack complexity and can cause a high availability impact.
Which versions contain the fix?
The issue is patched in BACnet Stack versions 1.4.5, 1.5.1, and 1.6.0-rc2.