CVE-2026-52789: BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests

Q: Which deployments are exposed to this issue?

Deployments using BACnet Stack versions earlier than 1.4.5, 1.5.1, or 1.6.0 are affected. The vulnerable component is the ReadPropertyMultiple handler in the BACnet Stack C library.

Q: What does an attacker need to trigger the denial of service?

An attacker needs to send a malformed ReadPropertyMultiple request packet that omits the expected closing tags. No privileges or user interaction are required, and the attack can be performed over the network.

Q: What is the impact of successful exploitation?

Processing the malformed request causes handler_read_property_multiple to enter an infinite loop. This can deny availability of the affected BACnet Stack service or device.

Q: How can this be remediated?

Upgrade to BACnet Stack version 1.4.5, 1.5.1, or 1.6.0, as applicable. These versions contain the fix for the malformed RPM request handling issue.

Published Nov 13, 2026

Updated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handlerreadpropertymultiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

Affected Software

1 affected component

BACnet Stack BACnet Stack<1.4.5, <1.5.1, <1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:56 PM

Data Sourced

via MITRE·03:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using BACnet Stack versions earlier than 1.4.5, 1.5.1, or 1.6.0 are affected. The vulnerable component is the ReadPropertyMultiple handler in the BACnet Stack C library.

What does an attacker need to trigger the denial of service?

An attacker needs to send a malformed ReadPropertyMultiple request packet that omits the expected closing tags. No privileges or user interaction are required, and the attack can be performed over the network.

What is the impact of successful exploitation?

Processing the malformed request causes handler_read_property_multiple to enter an infinite loop. This can deny availability of the affected BACnet Stack service or device.

How can this be remediated?

Upgrade to BACnet Stack version 1.4.5, 1.5.1, or 1.6.0, as applicable. These versions contain the fix for the malformed RPM request handling issue.

CVE-2026-52789: BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the denial of service?

What is the impact of successful exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the denial of service?

What is the impact of successful exploitation?

How can this be remediated?