CVE-2026-62974: BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is described as affecting the official BACnet Stack server demo. Deployments using that server code and handling BACnet WriteProperty requests are the relevant exposure described by the available information.
What does an attacker need to exploit it?
An attacker can send a malformed but non-empty BACnet WriteProperty request targeting Life_Safety_Zone PROP_ZONE_MEMBERS parsing. No authentication or user interaction is required, and the attack is remote.
Are patched versions available?
Yes. The issue is patched in versions 1.4.5, 1.5.1, and 1.6.0; versions prior to those releases are described as affected.
What happens when exploitation succeeds?
The affected request path can enter a non-terminating processing loop with repeated heap-backed side effects. This causes denial of service through uncontrolled resource consumption.