CVE-2026-58265: BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)

Q: Which deployments are exposed to this issue?

BACnet Stack deployments using versions earlier than 1.4.5, 1.5.1, or 1.6.0 are affected when they process BACnet/SC proprietary header options from a peer. The issue is reachable before authentication.

Q: What does an attacker need to exploit it?

An attacker needs to act as a BACnet/SC peer and send a proprietary header option whose declared header length is too short. No authentication or user interaction is required.

Q: What is the impact of successful exploitation?

The malformed option can cause a heap out-of-bounds read of up to three bytes while decoding the vendor ID and option type. The provided severity vector indicates low confidentiality impact and low availability impact, with no integrity impact.

Q: What should teams do if they cannot patch immediately?

The provided information does not identify a configuration workaround. Until upgrading, limit exposure to untrusted BACnet/SC peers where possible, since the vulnerable decoding occurs before authentication.

Q: How can I remediate the issue?

Upgrade BACnet Stack to version 1.4.5, 1.5.1, or 1.6.0, as appropriate for the release line in use. These versions contain the patch.

Published Nov 13, 2026

Updated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlcscdecodeproprietaryoption() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

Affected Software

1 affected component

BACnet Stack BACnet Stack<1.4.5, <1.5.1, <1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:58 PM

Data Sourced

via MITRE·03:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

BACnet Stack deployments using versions earlier than 1.4.5, 1.5.1, or 1.6.0 are affected when they process BACnet/SC proprietary header options from a peer. The issue is reachable before authentication.

What does an attacker need to exploit it?

An attacker needs to act as a BACnet/SC peer and send a proprietary header option whose declared header length is too short. No authentication or user interaction is required.

What is the impact of successful exploitation?

The malformed option can cause a heap out-of-bounds read of up to three bytes while decoding the vendor ID and option type. The provided severity vector indicates low confidentiality impact and low availability impact, with no integrity impact.

What should teams do if they cannot patch immediately?

The provided information does not identify a configuration workaround. Until upgrading, limit exposure to untrusted BACnet/SC peers where possible, since the vulnerable decoding occurs before authentication.

How can I remediate the issue?

Upgrade BACnet Stack to version 1.4.5, 1.5.1, or 1.6.0, as appropriate for the release line in use. These versions contain the patch.

CVE-2026-58265: BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should teams do if they cannot patch immediately?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should teams do if they cannot patch immediately?

How can I remediate the issue?