{"id":"CVE-2026-52790","kind":"vulnerability","aliases":["CVE-2026-52790"],"related":[],"title":"BACnet Stack: remote memory bug in writable device string properties","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A stack-use-after-return bug in writable Device string properties can be reached over BACnet/IP from the unmodified sample server, and it can corrupt memory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["version-patched"],"how_to_check":"- Check the BACnet Stack version in your build: look for the library version in your source tree or vendored copy, and compare against `1.4.5`, `1.5.1`, `1.6.0`.\n- Check whether your device runs the sample server (apps/server-basic/main.c) or a build based on it, reachable over BACnet/IP (UDP port 47808).","fix":"- Upgrade to `1.4.5` (1.4 line), `1.5.1` (1.5 line), or `1.6.0` (1.6 line).","status":"open","published_at":"2026-11-13T16:19:02+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:35+00:00","updated_at":"2026-11-13T16:48:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T16:48:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `1.4.5` (1.4 line), `1.5.1` (1.5 line), or `1.6.0` (1.6 line).","reach":"network","title":"BACnet Stack: remote memory bug in writable device string properties","impact":"high","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A stack-use-after-return bug in writable Device string properties can be reached over BACnet/IP from the unmodified sample server, and it can corrupt memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c","building-automation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"memory corruption reachable remotely over BACnet/IP network","analyst_note":"Confirm exploit conditions and whether writes to Device string properties need authentication; check the vendor advisory on github.com for details.","how_to_check":"- Check the BACnet Stack version in your build: look for the library version in your source tree or vendored copy, and compare against `1.4.5`, `1.5.1`, `1.6.0`.\n- Check whether your device runs the sample server (apps/server-basic/main.c) or a build based on it, reachable over BACnet/IP (UDP port 47808).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-patched"],"who_is_affected":"Teams that build firmware or gateways on the BACnet Stack C library and run its server code, especially the sample server, over BACnet/IP. Builds that do not expose the Device string properties over the network, or that run other versions outside the affected range, can skip it. The sources do not describe a specific default configuration beyond the sample server.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4617,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-52790':13A,16A '1.4.5':81C,126C '1.5.1':82C,127C '1.6.0':84C,129C 'apps/server-basic/main.c':103C 'autom':20B,35B 'bacnet':1A,17B,24B,32B,64C,68C 'bacnet/ip':53B,105C 'bug':5A,43B 'build':19B,31B,34B 'building-autom':18B,33B 'c':21B,28B,73C 'corrupt':62B 'cve':11A,14A 'devic':8A,36B,46B,116C 'embed':22B,76C 'issu':93C,120C 'level':90C 'librari':29B,74C,89C 'library-level':88C 'memori':4A,63B,91C 'offici':100C 'open':69C 'packag':23B 'patch':123C 'prior':78C 'properti':10A,48B,118C 'protocol':71C 'reach':51B 'reachabl':96C 'remot':3A 'result':106C 'return':42B,113C 'safeti':92C 'sampl':57B,101C 'server':58B,102C 'sourc':70C 'stack':2A,25B,39B,65C,72C,110C 'stack-use-after-return':38B,109C 'string':9A,47B,117C 'system':77C 'unmodifi':56B,99C 'use':40B,111C 'version':80C,125C 'writabl':7A,45B,115C","nicknames":[],"mitigations":[],"who_affected":"Teams that build firmware or gateways on the BACnet Stack C library and run its server code, especially the sample server, over BACnet/IP. Builds that do not expose the Device string properties over the network, or that run other versions outside the affected range, can skip it. The sources do not describe a specific default configuration beyond the sample server.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':12A,15A '-52790':13A,16A 'bacnet':1A 'bug':5A 'cve':11A,14A 'devic':8A 'memori':4A 'properti':10A 'remot':3A 'stack':2A 'string':9A 'writabl':7A","search_b":"'autom':20B,35B 'bacnet':17B,24B,32B 'bacnet/ip':53B 'bug':43B 'build':19B,31B,34B 'building-autom':18B,33B 'c':21B,28B 'corrupt':62B 'devic':36B,46B 'embed':22B 'librari':29B 'memori':63B 'packag':23B 'properti':48B 'reach':51B 'return':42B 'sampl':57B 'server':58B 'stack':25B,39B 'stack-use-after-return':38B 'string':47B 'unmodifi':56B 'use':40B 'writabl':45B","search_c":"'1.4.5':81C,126C '1.5.1':82C,127C '1.6.0':84C,129C 'apps/server-basic/main.c':103C 'bacnet':64C,68C 'bacnet/ip':105C 'c':73C 'devic':116C 'embed':76C 'issu':93C,120C 'level':90C 'librari':74C,89C 'library-level':88C 'memori':91C 'offici':100C 'open':69C 'patch':123C 'prior':78C 'properti':118C 'protocol':71C 'reachabl':96C 'result':106C 'return':113C 'safeti':92C 'sampl':101C 'server':102C 'sourc':70C 'stack':65C,72C,110C 'stack-use-after-return':109C 'string':117C 'system':77C 'unmodifi':99C 'use':111C 'version':80C,125C 'writabl':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:04:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52790","severity":null,"published_at":"2026-11-13T16:19:02+00:00","modified_at":"2026-11-13T16:19:02+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147670,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:04:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}