{"id":"CVE-2026-52786","kind":"vulnerability","aliases":["CVE-2026-52786"],"related":[],"title":"BACnet Stack EPICS tool: malicious device reply overflows a global buffer","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","summary":"The official EPICS client tool in BACnet Stack can be sent a crafted ReadPropertyMultiple reply that writes past a fixed global array in apps/epics/main.c. An attacker controlling a BACnet/IP endpoint the tool queries can corrupt memory over the network.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["library-only-use","trusted-network-only"],"how_to_check":"- Check the BACnet Stack version used to build the `apps/epics` tool; the flaw is in v1.6.0-rc1 and earlier releases before the fixed versions.\n- Look for `apps/epics/main.c` in your build and confirm whether it is built from a vulnerable tag.\n- Check whether the EPICS tool is run against untrusted BACnet/IP networks.","fix":"- BACnet Stack `1.4.5`\n- BACnet Stack `1.5.1`\n- BACnet Stack `1.6.0`","status":"open","published_at":"2026-11-12T20:18:42+00:00","first_seen_at":"2026-11-12T20:40:27+00:00","triaged_at":"2026-11-12T20:42:15+00:00","updated_at":"2026-11-12T20:42:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T20:42:15Z","model":"claude-haiku-5-5","output":{"fix":"- BACnet Stack `1.4.5`\n- BACnet Stack `1.5.1`\n- BACnet Stack `1.6.0`","reach":"network","title":"BACnet Stack EPICS tool: malicious device reply overflows a global buffer","impact":"high","summary":"The official EPICS client tool in BACnet Stack can be sent a crafted ReadPropertyMultiple reply that writes past a fixed global array in apps/epics/main.c. An attacker controlling a BACnet/IP endpoint the tool queries can corrupt memory over the network.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"memory corruption in the EPICS tool, possibly code execution","analyst_note":"product_name not set; products not listed in input.\n","how_to_check":"- Check the BACnet Stack version used to build the `apps/epics` tool; the flaw is in v1.6.0-rc1 and earlier releases before the fixed versions.\n- Look for `apps/epics/main.c` in your build and confirm whether it is built from a vulnerable tag.\n- Check whether the EPICS tool is run against untrusted BACnet/IP networks.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["library-only-use","trusted-network-only"],"who_is_affected":"Only teams that build or run the apps/epics client tool from BACnet Stack and point it at BACnet/IP devices they do not fully trust. The flaw is in the tool's response-processing path, not the generic RPM decoder, so embedded code that only uses the library without the EPICS tool is not the target. Teams using the tool only against their own controlled devices face lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000813,"input_tokens":4836,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-52786':14A,17A '1.4.5':81C,227C '1.5.1':82C,228C '1.6.0':84C,230C 'ack':99C,122C 'alon':101C 'apps/epics':88C,195C 'apps/epics/main.c':48B,171C 'array':46B,155C 'attack':50B 'autom':21B 'bacnet':1A,18B,31B,64C,68C,97C 'bacnet/ip':53B,104C 'buffer':11A,168C 'build':20B 'building-autom':19B 'c':22B,73C 'caus':192C 'client':28B,89C 'consum':144C 'contain':124C 'control':51B 'corrupt':59B,179C 'craft':37B 'cve':12A,15A 'decod':100C,140C 'devic':6A 'embed':23B,76C 'endpoint':54B,105C 'epic':3A,27B,110C,183C 'fix':44B,132C,153C,213C 'fixed-s':212C 'generic':96C 'global':10A,45B,154C,167C 'global-buffer-overflow':166C 'head':126C,217C 'heading-properti':216C 'hold':136C 'index':160C 'issu':221C 'later':143C 'legitim':113C 'length':202C 'librari':74C 'linear':159C 'list':205C 'local':133C,215C 'malici':5A,103C 'memori':60B,178C 'network':63B,176C 'network-reach':175C 'offici':26B,87C,182C 'open':69C 'overflow':8A,169C 'packag':24B 'past':42B 'patch':224C 'path':189C 'prior':78C 'process':188C 'processrpmdata':146C 'properti':127C,149C,204C,218C 'protocol':71C 'queri':57B 'reachabl':177C 'readpropertymultipl':38B,114C,121C 'readpropertymultiple-ack':120C 'remot':198C 'repli':7A,39B,107C 'reproduc':165C 'request':115C 'respons':138C,187C 'response-process':186C 'result':162C 'root':191C 'rpm':98C,203C 'sent':35B 'set':219C 'size':214C 'sourc':70C 'stack':2A,32B,65C,72C 'storag':134C 'success':141C 'suppli':199C 'syntact':118C 'system':77C 'tool':4A,29B,56B,90C,111C,130C,184C 'treat':196C 'trust':211C 'unbound':158C 'use':156C 'v1.6.0-rc1':92C 'valid':119C 'valu':150C 'variabl':201C 'variable-length':200C 'version':80C,226C 'write':41B,148C","nicknames":[],"mitigations":[],"who_affected":"Only teams that build or run the apps/epics client tool from BACnet Stack and point it at BACnet/IP devices they do not fully trust. The flaw is in the tool's response-processing path, not the generic RPM decoder, so embedded code that only uses the library without the EPICS tool is not the target. Teams using the tool only against their own controlled devices face lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-52786':14A,17A 'bacnet':1A 'buffer':11A 'cve':12A,15A 'devic':6A 'epic':3A 'global':10A 'malici':5A 'overflow':8A 'repli':7A 'stack':2A 'tool':4A","search_b":"'apps/epics/main.c':48B 'array':46B 'attack':50B 'autom':21B 'bacnet':18B,31B 'bacnet/ip':53B 'build':20B 'building-autom':19B 'c':22B 'client':28B 'control':51B 'corrupt':59B 'craft':37B 'embed':23B 'endpoint':54B 'epic':27B 'fix':44B 'global':45B 'memori':60B 'network':63B 'offici':26B 'packag':24B 'past':42B 'queri':57B 'readpropertymultipl':38B 'repli':39B 'sent':35B 'stack':32B 'tool':29B,56B 'write':41B","search_c":"'1.4.5':81C,227C '1.5.1':82C,228C '1.6.0':84C,230C 'ack':99C,122C 'alon':101C 'apps/epics':88C,195C 'apps/epics/main.c':171C 'array':155C 'bacnet':64C,68C,97C 'bacnet/ip':104C 'buffer':168C 'c':73C 'caus':192C 'client':89C 'consum':144C 'contain':124C 'corrupt':179C 'decod':100C,140C 'embed':76C 'endpoint':105C 'epic':110C,183C 'fix':132C,153C,213C 'fixed-s':212C 'generic':96C 'global':154C,167C 'global-buffer-overflow':166C 'head':126C,217C 'heading-properti':216C 'hold':136C 'index':160C 'issu':221C 'later':143C 'legitim':113C 'length':202C 'librari':74C 'linear':159C 'list':205C 'local':133C,215C 'malici':103C 'memori':178C 'network':176C 'network-reach':175C 'offici':87C,182C 'open':69C 'overflow':169C 'patch':224C 'path':189C 'prior':78C 'process':188C 'processrpmdata':146C 'properti':127C,149C,204C,218C 'protocol':71C 'reachabl':177C 'readpropertymultipl':114C,121C 'readpropertymultiple-ack':120C 'remot':198C 'repli':107C 'reproduc':165C 'request':115C 'respons':138C,187C 'response-process':186C 'result':162C 'root':191C 'rpm':98C,203C 'set':219C 'size':214C 'sourc':70C 'stack':65C,72C 'storag':134C 'success':141C 'suppli':199C 'syntact':118C 'system':77C 'tool':90C,111C,130C,184C 'treat':196C 'trust':211C 'unbound':158C 'use':156C 'v1.6.0-rc1':92C 'valid':119C 'valu':150C 'variabl':201C 'variable-length':200C 'version':80C,226C 'write':148C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52786","severity":null,"published_at":"2026-11-12T20:18:42+00:00","modified_at":"2026-11-12T20:18:42+00:00","first_seen_at":"2026-11-12T20:40:27+00:00","fetched_at":"2026-11-12T20:40:27+00:00","note":null}],"documents":[{"id":138288,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-c4q6-7827-mfg6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}