# cve.now: Bacnet-Stack

The newest entries naming Bacnet-Stack as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-64675](https://cve.now/CVE-2026-64675.md): BACnet Stack: Pre-auth OOB read in xy\_color\_decode (BACnetXYColor) via WriteGroup/WriteProperty (CVSS 5.3)
- [CVE-2026-104204](https://cve.now/CVE-2026-104204.md): BACnet Stack: Structured View subordinate-list\[0\] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS (CVSS 8.7)
- [CVE-2026-102612](https://cve.now/CVE-2026-102612.md): BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated (CVSS 8.1)
- [CVE-2026-97692](https://cve.now/CVE-2026-97692.md): BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory (CVSS 7.7)
- [CVE-2026-102537](https://cve.now/CVE-2026-102537.md): bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it (CVSS 7.7)
- [CVE-2026-100403](https://cve.now/CVE-2026-100403.md): BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory (CVSS 7.5)
- [CVE-2026-82414](https://cve.now/CVE-2026-82414.md): BACnet Stack: MS/TP COBS decode overflow (CVSS 8.8)
- [CVE-2026-62977](https://cve.now/CVE-2026-62977.md): BACnet Stack: \`WriteProperty(File\_Size)\` can bypass read-only protection and expose uninitialized RAMFS tail bytes through \`AtomicReadFile\` (CVSS 6.9)
- [CVE-2026-62976](https://cve.now/CVE-2026-62976.md): BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend (CVSS 8.7)
- [CVE-2026-62975](https://cve.now/CVE-2026-62975.md): BACnet Stack: Replacing a RAMFS record with a shorter one via \`AtomicWriteFile(record-access)\` can trigger a heap out-of-bounds read (CVSS 6.9)
- [CVE-2026-62974](https://cve.now/CVE-2026-62974.md): BACnet Stack: Remote unauthenticated DoS in \`Life\_Safety\_Zone\` \`PROP\_ZONE\_MEMBERS\` WriteProperty parsing (CVSS 8.7)
- [CVE-2026-62973](https://cve.now/CVE-2026-62973.md): BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK (CVSS 7.5)
- [CVE-2026-62972](https://cve.now/CVE-2026-62972.md): BACnet Stack: Out-of-bounds read in lighting\_command\_decode (full APDU size passed to nested tag decoders) (CVSS 6.9)
- [CVE-2026-58265](https://cve.now/CVE-2026-58265.md): BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc\_sc\_decode\_proprietary\_option) (CVSS 6.5)
- [CVE-2026-58498](https://cve.now/CVE-2026-58498.md): BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path (CVSS 8.6)
- [CVE-2026-52790](https://cve.now/CVE-2026-52790.md): BACnet Stack: bacnet\_device.c stack-use-after-return in writable Device string properties (CVSS 7.5)
- [CVE-2026-52789](https://cve.now/CVE-2026-52789.md): BACnet Stack: Denial of Service (Infinite Loop) in handler\_read\_property\_multiple via malformed RPM requests (CVSS 7.5)
- [CVE-2026-52788](https://cve.now/CVE-2026-52788.md): BACnet Stack: Buffer overflows in bsc\_node\_parse\_urls() (BACnet/SC Address Resolution ACK URL parser) (CVSS 8.8)
- [CVE-2026-52787](https://cve.now/CVE-2026-52787.md): BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address\_list\_encode() (CVSS 7.5)
- [CVE-2026-49990](https://cve.now/CVE-2026-49990.md): BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends (CVSS 8.6)
- [CVE-2026-49341](https://cve.now/CVE-2026-49341.md): BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow (CVSS 7.5)
- [CVE-2026-47711](https://cve.now/CVE-2026-47711.md): BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life\_Safety\_Zone.accepted-modes on the default BACnet/IP server (CVSS 8.6)
- [CVE-2026-47710](https://cve.now/CVE-2026-47710.md): BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow (CVSS 8.2)
- [CVE-2026-47259](https://cve.now/CVE-2026-47259.md): BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding (CVSS 8.2)
- [CVE-2026-47258](https://cve.now/CVE-2026-47258.md): BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding (CVSS 8.2)
- [CVE-2026-47257](https://cve.now/CVE-2026-47257.md): BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success (CVSS 8.1)
- [CVE-2026-47217](https://cve.now/CVE-2026-47217.md): BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server (CVSS 7.5)
- [CVE-2026-46677](https://cve.now/CVE-2026-46677.md): BACnet Stack: Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData\[\] Mismatch (CVSS 6.5)
- [CVE-2026-46676](https://cve.now/CVE-2026-46676.md): BACnet Stack: Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information… (CVSS 5.3)
- [CVE-2026-46674](https://cve.now/CVE-2026-46674.md): BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount (CVSS 7.5)
- [CVE-2026-45341](https://cve.now/CVE-2026-45341.md): BACnet Stack: NULL pointer dereference in bacnet\_device\_object\_reference\_decode() when WriteProperty updates Structured View… (CVSS 7.5)
- [CVE-2026-45265](https://cve.now/CVE-2026-45265.md): Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack (CVSS 8.2)
- [CVE-2026-52786](https://cve.now/CVE-2026-52786.md): BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData() (CVSS 7.1)
- [CVE-2026-41503](https://cve.now/CVE-2026-41503.md): BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser (CVSS 8.7)
- [CVE-2026-41502](https://cve.now/CVE-2026-41502.md): BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder (CVSS 8.7)
- [CVE-2026-41475](https://cve.now/CVE-2026-41475.md): BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser (CVSS 8.7)
- [CVE-2026-40279](https://cve.now/CVE-2026-40279.md): BACnet Stack: Undefined-behavior signed left shift in \`decode\_signed32()\` (CVSS 3.7)
- [CVE-2026-26264](https://cve.now/CVE-2026-26264.md): BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash (CVSS 7.8)
- [CVE-2026-21878](https://cve.now/CVE-2026-21878.md): BACnet Stack Improperly Limits Pathnames to a Restricted Directory (CVSS 7.5)
- [CVE-2026-21870](https://cve.now/CVE-2026-21870.md): The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer\_string (CVSS 5.5)
- [CVE-2025-66624](https://cve.now/CVE-2025-66624.md): BACnet-stack MS/TP reply matcher OOB read (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bacnet-stack
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.