{"id":"CVE-2026-52789","kind":"vulnerability","aliases":["CVE-2026-52789"],"related":[],"title":"BACnet Stack: malformed ReadPropertyMultiple request hangs the handler","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","summary":"BACnet Stack is a C library for building BACnet devices. A malformed ReadPropertyMultiple request missing its closing tags makes the handler loop forever, so the device stops responding.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","c","embedded","package"],"not_affected_if":["not-using-bacnet-stack"],"how_to_check":"- Check the version of the BACnet Stack library your device or application is built with, against the fixed versions below.\n- Look for the `handler_read_property_multiple` function in your build to confirm the library is included.","fix":"- Upgrade BACnet Stack to `1.4.5`, `1.5.1`, or `1.6.0`, matching your release line.","status":"open","published_at":"2026-11-13T16:19:02+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:35+00:00","updated_at":"2026-11-13T16:48:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T16:48:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade BACnet Stack to `1.4.5`, `1.5.1`, or `1.6.0`, matching your release line.","reach":"network","title":"BACnet Stack: malformed ReadPropertyMultiple request hangs the handler","impact":"low","summary":"BACnet Stack is a C library for building BACnet devices. A malformed ReadPropertyMultiple request missing its closing tags makes the handler loop forever, so the device stops responding.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Device stops responding due to an infinite loop on one packet","analyst_note":"","how_to_check":"- Check the version of the BACnet Stack library your device or application is built with, against the fixed versions below.\n- Look for the `handler_read_property_multiple` function in your build to confirm the library is included.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-using-bacnet-stack"],"who_is_affected":"Applications that embed the BACnet Stack C library and accept BACnet requests from the network can be stopped by a malformed ReadPropertyMultiple packet. Teams that only use BACnet tools or devices built by others should check with those vendors instead.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4640,"output_tokens":499,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-52789':11A,14A '1.4.5':64C,113C '1.5.1':65C,114C '1.6.0':67C,116C 'bacnet':1A,15B,19B,27B,47C,51C,77C 'build':26B 'c':16B,23B,56C 'close':35B,94C 'cve':9A,12A 'denial':69C 'devic':28B,44B 'dos':72C 'embed':17B,59C 'enter':102C 'exist':74C 'expect':93C 'forev':41B 'function':97C 'handler':8A,39B,82C,98C 'hang':6A 'infinit':104C 'issu':107C 'lack':91C 'librari':24B,57C 'loop':40B,105C 'make':37B 'malform':3A,30B,86C 'miss':33B 'multipl':101C 'open':52C 'packag':18B 'packet':89C 'patch':110C 'prior':61C 'process':84C 'properti':100C 'protocol':54C 'read':99C 'readpropertymultipl':4A,31B,80C 'request':5A,32B,88C 'respond':46B 'rpm':81C,87C 'servic':71C 'sourc':53C 'stack':2A,20B,48C,55C,78C 'stop':45B 'system':60C 'tag':36B,95C 'version':63C,112C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the BACnet Stack C library and accept BACnet requests from the network can be stopped by a malformed ReadPropertyMultiple packet. Teams that only use BACnet tools or devices built by others should check with those vendors instead.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':10A,13A '-52789':11A,14A 'bacnet':1A 'cve':9A,12A 'handler':8A 'hang':6A 'malform':3A 'readpropertymultipl':4A 'request':5A 'stack':2A","search_b":"'bacnet':15B,19B,27B 'build':26B 'c':16B,23B 'close':35B 'devic':28B,44B 'embed':17B 'forev':41B 'handler':39B 'librari':24B 'loop':40B 'make':37B 'malform':30B 'miss':33B 'packag':18B 'readpropertymultipl':31B 'request':32B 'respond':46B 'stack':20B 'stop':45B 'tag':36B","search_c":"'1.4.5':64C,113C '1.5.1':65C,114C '1.6.0':67C,116C 'bacnet':47C,51C,77C 'c':56C 'close':94C 'denial':69C 'dos':72C 'embed':59C 'enter':102C 'exist':74C 'expect':93C 'function':97C 'handler':82C,98C 'infinit':104C 'issu':107C 'lack':91C 'librari':57C 'loop':105C 'malform':86C 'multipl':101C 'open':52C 'packet':89C 'patch':110C 'prior':61C 'process':84C 'properti':100C 'protocol':54C 'read':99C 'readpropertymultipl':80C 'request':88C 'rpm':81C,87C 'servic':71C 'sourc':53C 'stack':48C,55C,78C 'system':60C 'tag':95C 'version':63C,112C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:04:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52789","severity":null,"published_at":"2026-11-13T16:19:02+00:00","modified_at":"2026-11-13T16:19:02+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147669,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:04:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}