{"id":"CVE-2026-47258","kind":"vulnerability","aliases":["CVE-2026-47258"],"related":[],"title":"BACnet Stack: stack overflow in Notification Class lets attackers write memory","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.","summary":"BACnet Stack is a C library for BACnet building-automation devices. A stack-based out-of-bounds write in the Notification Class object's recipient-list handling (AddListElement) lets a crafted request corrupt device memory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["not-network-reachable","notification-class-not-compiled"],"how_to_check":"- Find BACnet Stack builds in firmware or build files and check the version, for example `grep -ri bacnet` in the source tree.\n- Confirm whether the Notification Class object is compiled in and reachable from the network.","fix":"- BACnet Stack: upgrade to `1.4.4`, `1.5.1`, or `1.6.0` (match your release line).","status":"open","published_at":"2026-11-12T20:18:40+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:04+00:00","updated_at":"2026-11-12T20:42:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T20:42:04Z","model":"claude-haiku-5-5","output":{"fix":"- BACnet Stack: upgrade to `1.4.4`, `1.5.1`, or `1.6.0` (match your release line).","reach":"network","title":"BACnet Stack: stack overflow in Notification Class lets attackers write memory","impact":"high","summary":"BACnet Stack is a C library for BACnet building-automation devices. A stack-based out-of-bounds write in the Notification Class object's recipient-list handling (AddListElement) lets a crafted request corrupt device memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"memory corruption on the device, possibly code execution","analyst_note":"Confirm whether the Notification Class object is enabled by default and whether authentication is required, using the vendor advisory linked in the sources.","how_to_check":"- Find BACnet Stack builds in firmware or build files and check the version, for example `grep -ri bacnet` in the source tree.\n- Confirm whether the Notification Class object is compiled in and reachable from the network.","plain_action":"","product_name":"bacnet-stack","needs_analyst":true,"not_affected_if":["notification-class-not-compiled","not-network-reachable"],"who_is_affected":"Products built on BACnet Stack that expose the Notification Class object over BACnet/IP are the ones to check; the sources do not say which vendors or devices ship it. Builds that do not include the Notification Class object, or that are not reachable from the network, are less exposed. The sources do not say whether authentication is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4590,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-47258':14A,17A '1.4.4':81C,117C '1.5.1':82C,118C '1.6.0':84C,120C 'addlistel':56B,103C 'attack':9A 'autom':21B,35B 'bacnet':1A,18B,25B,32B,64C,68C 'base':40B,88C 'bound':44B,92C 'build':20B,34B 'building-autom':19B,33B 'c':22B,29B,73C 'class':7A,49B,98C 'corrupt':61B 'craft':59B 'cve':12A,15A 'devic':36B,62B 'embed':23B,76C 'exist':94C 'handl':55B,102C 'implement':100C 'issu':111C 'let':8A,57B 'librari':30B,74C 'list':54B,108C 'memori':11A,63B 'notif':6A,48B,97C 'object':50B,99C 'open':69C 'out-of-bound':41B,89C 'overflow':4A 'packag':24B 'patch':114C 'prior':78C 'properti':109C 'protocol':71C 'recipi':53B,107C 'recipient-list':52B,106C 'request':60B 'sourc':70C 'stack':2A,3A,26B,39B,65C,72C,87C 'stack-bas':38B,86C 'system':77C 'version':80C,116C 'write':10A,45B,93C","nicknames":[],"mitigations":[],"who_affected":"Products built on BACnet Stack that expose the Notification Class object over BACnet/IP are the ones to check; the sources do not say which vendors or devices ship it. Builds that do not include the Notification Class object, or that are not reachable from the network, are less exposed. The sources do not say whether authentication is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-47258':14A,17A 'attack':9A 'bacnet':1A 'class':7A 'cve':12A,15A 'let':8A 'memori':11A 'notif':6A 'overflow':4A 'stack':2A,3A 'write':10A","search_b":"'addlistel':56B 'autom':21B,35B 'bacnet':18B,25B,32B 'base':40B 'bound':44B 'build':20B,34B 'building-autom':19B,33B 'c':22B,29B 'class':49B 'corrupt':61B 'craft':59B 'devic':36B,62B 'embed':23B 'handl':55B 'let':57B 'librari':30B 'list':54B 'memori':63B 'notif':48B 'object':50B 'out-of-bound':41B 'packag':24B 'recipi':53B 'recipient-list':52B 'request':60B 'stack':26B,39B 'stack-bas':38B 'write':45B","search_c":"'1.4.4':81C,117C '1.5.1':82C,118C '1.6.0':84C,120C 'addlistel':103C 'bacnet':64C,68C 'base':88C 'bound':92C 'c':73C 'class':98C 'embed':76C 'exist':94C 'handl':102C 'implement':100C 'issu':111C 'librari':74C 'list':108C 'notif':97C 'object':99C 'open':69C 'out-of-bound':89C 'patch':114C 'prior':78C 'properti':109C 'protocol':71C 'recipi':107C 'recipient-list':106C 'sourc':70C 'stack':65C,72C,87C 'stack-bas':86C 'system':77C 'version':80C,116C 'write':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47258","severity":null,"published_at":"2026-11-12T20:18:40+00:00","modified_at":"2026-11-12T20:18:40+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138284,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rjmv-3mcm-r83j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}