GHSA-9w9m-w7w5-rrv3: BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding
Published Nov 12, 2026
·Updated
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NCMAXRECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Affected Software
1 affected component
BACnet Stack BACnet Stack<1.4.4, <1.5.1, <1.6.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0
Event History
Nov 12, 2026
CVE Published
via OSV·08:02 PM
Data Sourced
via OSV·08:02 PM
DescriptionSeverityWeakness