CVE-2026-52786 · Package
NO FIX YET · SEE WHAT TO DO
The official EPICS client tool in BACnet Stack can be sent a crafted ReadPropertyMultiple reply that writes past a fixed global array in apps/epics/main.c. An attacker controlling a BACnet/IP endpoint the tool queries can corrupt memory over the network.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only teams that build or run the apps/epics client tool from BACnet Stack and point it at BACnet/IP devices they do not fully trust. The flaw is in the tool's response-processing path, not the generic RPM decoder, so embedded code that only uses the library without the EPICS tool is not the target. Teams using the tool only against their own controlled devices face lower risk.
Not affected if library-only-use, trusted-network-only
Who cares bacnet, building-automation, c, embedded
apps/epics tool; the flaw is in v1.6.0-rc1 and earlier releases before the fixed versions.apps/epics/main.c in your build and confirm whether it is built from a vulnerable tag.1.4.51.5.11.6.0BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.