{"id":"CVE-2026-47259","kind":"vulnerability","aliases":["CVE-2026-47259"],"related":[],"title":"BACnet Stack: oversized list request causes stack out-of-bounds write","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.","summary":"BACnet Stack is an open source BACnet protocol C library used in embedded building-automation devices. A crafted RemoveListElement request with more than NC_MAX_RECIPIENTS destinations writes past a stack buffer, which can corrupt memory on the device.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BACnet Stack","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["no-bacnet-writes-exposed"],"how_to_check":"- Check the BACnet Stack version in your build or vendored source, for example by reading the version define in the library headers\n- Look for Notification-Class objects that accept RemoveListElement writes from the network","fix":"- Move to `1.4.4`, `1.5.1`, or `1.6.0` depending on your release line","status":"open","published_at":"2026-11-12T20:18:40+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:04+00:00","updated_at":"2026-11-12T20:42:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T20:42:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.4.4`, `1.5.1`, or `1.6.0` depending on your release line","reach":"network","title":"BACnet Stack: oversized list request causes stack out-of-bounds write","impact":"high","summary":"BACnet Stack is an open source BACnet protocol C library used in embedded building-automation devices. A crafted RemoveListElement request with more than NC_MAX_RECIPIENTS destinations writes past a stack buffer, which can corrupt memory on the device.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c","building-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"code runs on the device via memory corruption","analyst_note":"Confirm whether a BACnet request needs authentication and which default configurations expose RemoveListElement; check the vendor advisory linked on github.com.","how_to_check":"- Check the BACnet Stack version in your build or vendored source, for example by reading the version define in the library headers\n- Look for Notification-Class objects that accept RemoveListElement writes from the network\n- unknown otherwise","plain_action":"","product_name":"BACnet Stack","needs_analyst":true,"not_affected_if":["no-bacnet-writes-exposed"],"who_is_affected":"Teams that build or ship firmware on the BACnet Stack C library, especially devices that accept BACnet network writes to Notification-Class recipient lists. Systems that do not link this library, or that never expose BACnet writes to the network, are less exposed. The sources do not say which devices or default configurations are reachable.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4628,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-47259':15A,18A '1.4.4':85C,130C '1.5.1':86C,131C '1.6.0':88C,133C 'autom':24B,43B 'bacnet':1A,19A,21B,28B,34B,68C,72C 'bacnetdestin':121C 'base':100C 'bound':11A,104C 'branch':110C 'buffer':60B 'build':23B,42B 'building-autom':22B,41B 'c':25B,36B,77C 'caus':6A 'contain':114C 'corrupt':63B 'craft':46B 'current':108C 'cve':13A,16A 'destin':55B 'devic':44B,67B 'element':122C 'embed':26B,40B,80C 'issu':124C 'librari':37B,78C 'list':4A,94C 'master':109C 'max':53B,118C 'memori':64B 'nc':52B,117C 'notification-class.recipient':93C 'open':32B,73C 'out-of-bound':8A,101C 'overs':3A 'packag':27B 'past':57B 'patch':127C 'prior':82C 'protocol':35B,75C 'recipi':54B,119C 'removelistel':47B,90C 'request':5A,48B,91C,113C 'sourc':33B,74C 'stack':2A,7A,20A,29B,59B,69C,76C,99C 'stack-bas':98C 'system':81C 'target':92C 'trigger':96C 'use':38B 'valid':120C 'version':84C,129C 'write':12A,56B,105C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or ship firmware on the BACnet Stack C library, especially devices that accept BACnet network writes to Notification-Class recipient lists. Systems that do not link this library, or that never expose BACnet writes to the network, are less exposed. The sources do not say which devices or default configurations are reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["bacnetstack","stack"],"ptokens":["bacnet","stack"],"labels":["bacnet","buildingautomation","c","embedded","high","package","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-47259':15A,18A 'bacnet':1A,19A 'bound':11A 'caus':6A 'cve':13A,16A 'list':4A 'out-of-bound':8A 'overs':3A 'request':5A 'stack':2A,7A,20A 'write':12A","search_b":"'autom':24B,43B 'bacnet':21B,28B,34B 'buffer':60B 'build':23B,42B 'building-autom':22B,41B 'c':25B,36B 'corrupt':63B 'craft':46B 'destin':55B 'devic':44B,67B 'embed':26B,40B 'librari':37B 'max':53B 'memori':64B 'nc':52B 'open':32B 'packag':27B 'past':57B 'protocol':35B 'recipi':54B 'removelistel':47B 'request':48B 'sourc':33B 'stack':29B,59B 'use':38B 'write':56B","search_c":"'1.4.4':85C,130C '1.5.1':86C,131C '1.6.0':88C,133C 'bacnet':68C,72C 'bacnetdestin':121C 'base':100C 'bound':104C 'branch':110C 'c':77C 'contain':114C 'current':108C 'element':122C 'embed':80C 'issu':124C 'librari':78C 'list':94C 'master':109C 'max':118C 'nc':117C 'notification-class.recipient':93C 'open':73C 'out-of-bound':101C 'patch':127C 'prior':82C 'protocol':75C 'recipi':119C 'removelistel':90C 'request':91C,113C 'sourc':74C 'stack':69C,76C,99C 'stack-bas':98C 'system':81C 'target':92C 'trigger':96C 'valid':120C 'version':84C,129C 'write':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47259","severity":null,"published_at":"2026-11-12T20:18:40+00:00","modified_at":"2026-11-12T20:18:40+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138285,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9w9m-w7w5-rrv3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}