CVE-2026-82414: BACnet Stack: MS/TP COBS decode overflow
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the BACnet MS/TP receive path are affected if they run BACnet Stack 1.4.0 through before 1.4.6, 1.5.0 through before 1.5.1, or 1.6.0 through before 1.6.1.
What does an attacker need to exploit this issue?
An attacker needs network access to send a long, valid COBS payload to the affected BACnet MS/TP receive path. No privileges or user interaction are required.
Which versions contain the fix?
The issue is patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.