CVE-2026-47258 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for BACnet building-automation devices. A stack-based out-of-bounds write in the Notification Class object's recipient-list handling (AddListElement) lets a crafted request corrupt device memory.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Products built on BACnet Stack that expose the Notification Class object over BACnet/IP are the ones to check; the sources do not say which vendors or devices ship it. Builds that do not include the Notification Class object, or that are not reachable from the network, are less exposed. The sources do not say whether authentication is required.
Not affected if not-network-reachable, notification-class-not-compiled
Who cares bacnet, building-automation, c, embedded
grep -ri bacnet in the source tree.1.4.4, 1.5.1, or 1.6.0 (match your release line).BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.