CVE-2026-62973: BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK

Q: Which deployments are exposed to this issue?

Deployments using the official BACnet Stack client application apps/readpropm are exposed if they run a version earlier than 1.4.5, 1.5.1, or 1.6.0 and communicate with BACnet/IP peers.

Q: What must an attacker do to trigger the vulnerability?

A malicious BACnet/IP peer must receive a legitimate ReadPropertyMultiple request from readpropm and return a malformed but structurally valid ReadPropertyMultiple-ACK. No privileges or user interaction are required.

Q: What can be done if upgrading is not immediately possible?

Avoid using apps/readpropm against untrusted BACnet/IP peers. Limit BACnet/IP communication to trusted peers until the affected client can be updated.

Q: How can I determine whether I am affected?

Check whether the deployment uses apps/readpropm and whether its BACnet Stack version predates 1.4.5, 1.5.1, or 1.6.0. The issue is triggered when that client sends ReadPropertyMultiple requests to a malicious BACnet/IP peer.

Published Nov 13, 2026

Updated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer RxBuf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

Affected Software

1 affected component

BACnet Stack BACnet Stack<1.4.5, <1.5.1, <1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:59 PM

Data Sourced

via MITRE·03:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the official BACnet Stack client application apps/readpropm are exposed if they run a version earlier than 1.4.5, 1.5.1, or 1.6.0 and communicate with BACnet/IP peers.

What must an attacker do to trigger the vulnerability?

A malicious BACnet/IP peer must receive a legitimate ReadPropertyMultiple request from readpropm and return a malformed but structurally valid ReadPropertyMultiple-ACK. No privileges or user interaction are required.

What can be done if upgrading is not immediately possible?

Avoid using apps/readpropm against untrusted BACnet/IP peers. Limit BACnet/IP communication to trusted peers until the affected client can be updated.

How can I determine whether I am affected?

Check whether the deployment uses apps/readpropm and whether its BACnet Stack version predates 1.4.5, 1.5.1, or 1.6.0. The issue is triggered when that client sends ReadPropertyMultiple requests to a malicious BACnet/IP peer.

CVE-2026-62973: BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What can be done if upgrading is not immediately possible?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What can be done if upgrading is not immediately possible?

How can I determine whether I am affected?