---
id: "CVE-2026-52786"
page: "https://infrastack.ai/live/CVE-2026-52786"
kind: "vulnerability"
aliases: ["CVE-2026-52786"]
title: "BACnet Stack EPICS tool: malicious device reply overflows a global buffer"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bacnet", "building-automation", "c", "embedded", "package"]
not_affected_if: ["library-only-use", "trusted-network-only"]
published_at: "2026-11-12T20:18:42+00:00"
first_seen_at: "2026-11-12T20:40:27+00:00"
updated_at: "2026-11-12T20:42:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52786", "first_seen_at": "2026-11-12T20:40:27+00:00"}]
exploit_sources: []
---

# BACnet Stack EPICS tool: malicious device reply overflows a global buffer

Link for people: https://infrastack.ai/live/CVE-2026-52786 (this .md is for agents)

The official EPICS client tool in BACnet Stack can be sent a crafted ReadPropertyMultiple reply that writes past a fixed global array in apps/epics/main.c. An attacker controlling a BACnet/IP endpoint the tool queries can corrupt memory over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BACnet Stack version used to build the `apps/epics` tool; the flaw is in v1.6.0-rc1 and earlier releases before the fixed versions.
- Look for `apps/epics/main.c` in your build and confirm whether it is built from a vulnerable tag.
- Check whether the EPICS tool is run against untrusted BACnet/IP networks.

## Fix

- BACnet Stack `1.4.5`
- BACnet Stack `1.5.1`
- BACnet Stack `1.6.0`

## Timeline

- 2026-11-12T20:40:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-52786

## Documents

- [advisory] Vendor advisory: github.com https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-c4q6-7827-mfg6

## From the sources

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_