Bacnet-Stack CVEs
41 CVEs and advisories name Bacnet-Stack as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-64675BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
- CVE-2026-104204BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS
- CVE-2026-102612BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated
- CVE-2026-97692BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory
- CVE-2026-102537bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it
- CVE-2026-100403BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory
- CVE-2026-82414BACnet Stack: MS/TP COBS decode overflow
- CVE-2026-62977BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`
- CVE-2026-62976BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
- CVE-2026-62975BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read
- CVE-2026-62974BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing
- CVE-2026-62973BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
- CVE-2026-62972BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
- CVE-2026-58265BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)
- CVE-2026-58498BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path
- CVE-2026-52790BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties
- CVE-2026-52789BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests
- CVE-2026-52788BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)
- CVE-2026-52787BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()
- CVE-2026-49990BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends
- CVE-2026-49341BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow
- CVE-2026-47711BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
- CVE-2026-47710BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow
- CVE-2026-47259BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding
- CVE-2026-47258BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding
- CVE-2026-47257BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success
- CVE-2026-47217BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server
- CVE-2026-46677BACnet Stack: Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData[] Mismatch
- CVE-2026-46676BACnet Stack: Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information…
- CVE-2026-46674BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount