BACNET STACK · CVE-2026-47259 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is an open source BACnet protocol C library used in embedded building-automation devices. A crafted RemoveListElement request with more than NC_MAX_RECIPIENTS destinations writes past a stack buffer, which can corrupt memory on the device.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that build or ship firmware on the BACnet Stack C library, especially devices that accept BACnet network writes to Notification-Class recipient lists. Systems that do not link this library, or that never expose BACnet writes to the network, are less exposed. The sources do not say which devices or default configurations are reachable.
Not affected if no-bacnet-writes-exposed
Who cares bacnet, building-automation, c, embedded
1.4.4, 1.5.1, or 1.6.0 depending on your release lineBACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.