BACNET-STACK · CVE-2026-47217 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is an open source BACnet protocol library in C used in embedded building-automation devices. A remote attacker can trigger unbounded recursion through the Channel object, overflowing the stack in the default server application.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that build or run applications on bacnet-stack versions before 1.4.4 or 1.5.1 that use the default server application with the Channel object exposed to the network. Systems that do not use the default server application or the Channel object are less exposed, but the sources do not say which configuration is the default for every build. unknown beyond that.
Not affected if bacnet-stack-1.4.4-or-later, bacnet-stack-1.5.1-or-later
Who cares bacnet, c, embedded
grep -ri bacnet in your project's dependency or source tree.1.4.4 on the 1.4 line1.5.1 on the 1.5 lineBACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, a remote attacker can trigger an uncontrolled recursion and stack overflow in the default server application of bacnet-stack by abusing the Channel object. This issue has been patched in versions 1.4.4 and 1.5.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.