{"id":"CVE-2026-52787","kind":"vulnerability","aliases":["CVE-2026-52787"],"related":[],"title":"BACnet Stack: out-of-bounds write when encoding device address-binding property","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2.","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A reachable out-of-bounds write when encoding the device.address-binding property can corrupt memory, which may let an attacker crash or take over the device running it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","c","embedded","package"],"not_affected_if":["unused-library"],"how_to_check":"- Check the BACnet Stack version your device or firmware is built from; versions before `1.4.5`, `1.5.1`, and `1.6.0-rc2` are affected.\n- Check whether your build includes the device object address-binding property encoding (unknown whether this is on by default).","fix":"- Upgrade to `1.4.5`, `1.5.1`, or `1.6.0-rc2`, matching your release branch.","status":"open","published_at":"2026-11-13T16:19:02+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:36+00:00","updated_at":"2026-11-13T16:48:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T16:48:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `1.4.5`, `1.5.1`, or `1.6.0-rc2`, matching your release branch.","reach":"network","title":"BACnet Stack: out-of-bounds write when encoding device address-binding property","impact":"high","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A reachable out-of-bounds write when encoding the device.address-binding property can corrupt memory, which may let an attacker crash or take over the device running it.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"memory corruption in a BACnet device could allow code execution","analyst_note":"","how_to_check":"- Check the BACnet Stack version your device or firmware is built from; versions before `1.4.5`, `1.5.1`, and `1.6.0-rc2` are affected.\n- Check whether your build includes the device object address-binding property encoding (unknown whether this is on by default).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["unused-library"],"who_is_affected":"Teams that embed or ship BACnet Stack in building-automation controllers, gateways or test tools. Exposure depends on whether BACnet traffic from the network can reach the encoding path for device.address-binding. Products that do not use this library can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4582,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-52787':17A,20A '1.4.5':83C,109C '1.5.1':84C,110C '1.6.0':86C,112C 'address':12A 'address-bind':11A 'attack':58B 'autom':36B 'bacnet':1A,21B,25B,33B,66C,70C 'bind':13A,49B,100C 'bound':6A,43B,93C 'build':32B,35B 'building-autom':34B 'c':22B,29B,75C 'corrupt':52B 'crash':59B 'cve':15A,18A 'devic':10A,37B,64B 'device.address':48B,99C 'embed':23B,78C 'encod':9A,46B,97C 'exist':95C 'issu':103C 'let':56B 'librari':30B,76C 'may':55B 'memori':53B 'open':71C 'out-of-bound':3A,40B,90C 'packag':24B 'patch':106C 'prior':80C 'properti':14A,50B,101C 'protocol':73C 'rc2':87C,113C 'reachabl':39B,89C 'run':65B 'sourc':72C 'stack':2A,26B,67C,74C 'system':79C 'take':61B 'version':82C,108C 'write':7A,44B,94C","nicknames":[],"mitigations":[],"who_affected":"Teams that embed or ship BACnet Stack in building-automation controllers, gateways or test tools. Exposure depends on whether BACnet traffic from the network can reach the encoding path for device.address-binding. Products that do not use this library can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':16A,19A '-52787':17A,20A 'address':12A 'address-bind':11A 'bacnet':1A 'bind':13A 'bound':6A 'cve':15A,18A 'devic':10A 'encod':9A 'out-of-bound':3A 'properti':14A 'stack':2A 'write':7A","search_b":"'attack':58B 'autom':36B 'bacnet':21B,25B,33B 'bind':49B 'bound':43B 'build':32B,35B 'building-autom':34B 'c':22B,29B 'corrupt':52B 'crash':59B 'devic':37B,64B 'device.address':48B 'embed':23B 'encod':46B 'let':56B 'librari':30B 'may':55B 'memori':53B 'out-of-bound':40B 'packag':24B 'properti':50B 'reachabl':39B 'run':65B 'stack':26B 'take':61B 'write':44B","search_c":"'1.4.5':83C,109C '1.5.1':84C,110C '1.6.0':86C,112C 'bacnet':66C,70C 'bind':100C 'bound':93C 'c':75C 'device.address':99C 'embed':78C 'encod':97C 'exist':95C 'issu':103C 'librari':76C 'open':71C 'out-of-bound':90C 'patch':106C 'prior':80C 'properti':101C 'protocol':73C 'rc2':87C,113C 'reachabl':89C 'sourc':72C 'stack':67C,74C 'system':79C 'version':82C,108C 'write':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52787","severity":null,"published_at":"2026-11-13T16:19:02+00:00","modified_at":"2026-11-13T16:19:02+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147667,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}