{"id":"CVE-2026-47710","kind":"vulnerability","aliases":["CVE-2026-47710"],"related":[],"title":"BACnet Stack: long property string overflows a stack buffer in Loop objects","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-buffer-overflow can be triggered in the current master branch when a Loop object reads a referenced property through its default timer path and the referenced property is OBJECT_STRUCTURED_VIEW / PROP_DESCRIPTION containing a long attacker-controlled string. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.","summary":"BACnet Stack is an open source C library for building-automation devices that speak the BACnet protocol. A long attacker-controlled description string in a Structured View object, read through a Loop object's default timer path, overflows a stack buffer.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["patched-version"],"how_to_check":"- Check the BACnet Stack version in use: `unknown` if the sources do not name the build or package the team uses.\n- Look for the Loop object and Structured View objects in the device configuration.","fix":"- BACnet Stack: `1.4.4`, `1.5.1`, or `1.6.0`, matching the release line in use.","status":"open","published_at":"2026-11-12T20:18:40+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:00+00:00","updated_at":"2026-11-12T20:42:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T20:42:00Z","model":"claude-haiku-5-5","output":{"fix":"- BACnet Stack: `1.4.4`, `1.5.1`, or `1.6.0`, matching the release line in use.","reach":"network","title":"BACnet Stack: long property string overflows a stack buffer in Loop objects","impact":"high","summary":"BACnet Stack is an open source C library for building-automation devices that speak the BACnet protocol. A long attacker-controlled description string in a Structured View object, read through a Loop object's default timer path, overflows a stack buffer.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Stack memory corrupted; code may run on the device","analyst_note":"","how_to_check":"- Check the BACnet Stack version in use: `unknown` if the sources do not name the build or package the team uses.\n- Look for the Loop object and Structured View objects in the device configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Teams that build or run devices or gateways on BACnet Stack, where a Loop object reads a Structured View object's description property through the default timer path. The sources do not say whether the default configuration exposes this path to remote peers. Systems that do not use BACnet Stack, or that run a patched release, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4639,"output_tokens":519,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-47710':15A,18A '1.4.4':86C,140C '1.5.1':87C,141C '1.6.0':89C,143C 'attack':47B,130C 'attacker-control':46B,129C 'autom':22B,37B 'bacnet':1A,19B,26B,42B,69C,73C 'branch':102C 'buffer':9A,68B,93C 'build':21B,36B 'building-autom':20B,35B 'c':23B,32B,78C 'contain':126C 'control':48B,131C 'current':100C 'cve':13A,16A 'default':62B,113C 'descript':49B,125C 'devic':38B 'embed':24B,81C 'issu':134C 'librari':33B,79C 'long':3A,45B,128C 'loop':11A,59B,105C 'master':101C 'object':12A,55B,60B,106C,121C 'open':30B,74C 'overflow':6A,65B,94C 'packag':25B 'patch':137C 'path':64B,115C 'prior':83C 'prop':124C 'properti':4A,110C,119C 'protocol':43B,76C 'read':56B,107C 'referenc':109C,118C 'sourc':31B,75C 'speak':40B 'stack':2A,8A,27B,67B,70C,77C,92C 'stack-buffer-overflow':91C 'string':5A,50B,132C 'structur':53B,122C 'system':82C 'timer':63B,114C 'trigger':97C 'version':85C,139C 'view':54B,123C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run devices or gateways on BACnet Stack, where a Loop object reads a Structured View object's description property through the default timer path. The sources do not say whether the default configuration exposes this path to remote peers. Systems that do not use BACnet Stack, or that run a patched release, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':14A,17A '-47710':15A,18A 'bacnet':1A 'buffer':9A 'cve':13A,16A 'long':3A 'loop':11A 'object':12A 'overflow':6A 'properti':4A 'stack':2A,8A 'string':5A","search_b":"'attack':47B 'attacker-control':46B 'autom':22B,37B 'bacnet':19B,26B,42B 'buffer':68B 'build':21B,36B 'building-autom':20B,35B 'c':23B,32B 'control':48B 'default':62B 'descript':49B 'devic':38B 'embed':24B 'librari':33B 'long':45B 'loop':59B 'object':55B,60B 'open':30B 'overflow':65B 'packag':25B 'path':64B 'protocol':43B 'read':56B 'sourc':31B 'speak':40B 'stack':27B,67B 'string':50B 'structur':53B 'timer':63B 'view':54B","search_c":"'1.4.4':86C,140C '1.5.1':87C,141C '1.6.0':89C,143C 'attack':130C 'attacker-control':129C 'bacnet':69C,73C 'branch':102C 'buffer':93C 'c':78C 'contain':126C 'control':131C 'current':100C 'default':113C 'descript':125C 'embed':81C 'issu':134C 'librari':79C 'long':128C 'loop':105C 'master':101C 'object':106C,121C 'open':74C 'overflow':94C 'patch':137C 'path':115C 'prior':83C 'prop':124C 'properti':110C,119C 'protocol':76C 'read':107C 'referenc':109C,118C 'sourc':75C 'stack':70C,77C,92C 'stack-buffer-overflow':91C 'string':132C 'structur':122C 'system':82C 'timer':114C 'trigger':97C 'version':85C,139C 'view':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47710","severity":null,"published_at":"2026-11-12T20:18:40+00:00","modified_at":"2026-11-12T20:18:40+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138286,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2xm5-gjpc-9m6q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}