CVE-2026-52790 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for building BACnet building-automation devices. A stack-use-after-return bug in writable Device string properties can be reached over BACnet/IP from the unmodified sample server, and it can corrupt memory.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that build firmware or gateways on the BACnet Stack C library and run its server code, especially the sample server, over BACnet/IP. Builds that do not expose the Device string properties over the network, or that run other versions outside the affected range, can skip it. The sources do not describe a specific default configuration beyond the sample server.
Not affected if version-patched
Who cares bacnet, building-automation, c, embedded
1.4.5, 1.5.1, 1.6.0.1.4.5 (1.4 line), 1.5.1 (1.5 line), or 1.6.0 (1.6 line).BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.