{"id":"CVE-2026-58265","kind":"vulnerability","aliases":["CVE-2026-58265"],"related":[],"title":"BACnet Stack: malformed BACnet/SC packet causes heap out-of-bounds read","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","summary":"BACnet Stack is an open source BACnet protocol C library for embedded systems. A remote BACnet/SC peer can send a crafted proprietary header option that makes the decoder read up to 3 bytes past a heap buffer, before any authentication.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["bacnet-sc-disabled","versions-patched"],"how_to_check":"- Check the BACnet Stack version in your build or lockfile, e.g. the library's source tree or package manifest.\n- Look for BACnet/SC support enabled in the build (bvlc_sc_decode_proprietary_option in the BACnet/SC code path).","fix":"- Upgrade to `1.4.5`, `1.5.1`, or `1.6.0` on the matching release line.","status":"open","published_at":"2026-11-13T16:19:12+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:49+00:00","updated_at":"2026-11-13T16:48:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T16:48:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `1.4.5`, `1.5.1`, or `1.6.0` on the matching release line.","reach":"network","title":"BACnet Stack: malformed BACnet/SC packet causes heap out-of-bounds read","impact":"low","summary":"BACnet Stack is an open source BACnet protocol C library for embedded systems. A remote BACnet/SC peer can send a crafted proprietary header option that makes the decoder read up to 3 bytes past a heap buffer, before any authentication.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"out-of-bounds heap read leaks up to three bytes of memory","analyst_note":"","how_to_check":"- Check the BACnet Stack version in your build or lockfile, e.g. the library's source tree or package manifest.\n- Look for BACnet/SC support enabled in the build (bvlc_sc_decode_proprietary_option in the BACnet/SC code path).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["bacnet-sc-disabled","versions-patched"],"who_is_affected":"Teams that compile BACnet Stack into embedded building-automation or device firmware and enable BACnet/SC. Exposure needs a peer that can reach the BACnet/SC service; builds without BACnet/SC can skip it. The sources do not say which products bundle the library.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4686,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58265':15A,18A '1.4.5':83C,162C '1.5.1':84C,163C '1.6.0':86C,165C '3':57B,101C,130C '4':131C '5':132C 'authent':65B,105C 'autom':22B 'bacnet':1A,19B,26B,32B,66C,70C 'bacnet/sc':4A,41B,88C,108C 'bound':11A,97C 'buffer':62B 'build':21B 'building-autom':20B 'bvlc':113C 'byte':58B,102C 'c':23B,34B,75C 'caus':6A 'check':134C 'craft':46B 'cve':13A,16A 'declar':138C 'decod':53B,112C,115C 'embed':24B,37B,78C 'enforc':148C 'fix':128C 'header':48B,110C,139C 'header-opt':109C 'heap':7A,61B,93C 'id':122C 'issu':156C 'length':140C,151C 'librari':35B,76C 'list':145C 'make':51B 'malform':3A 'minimum':150C 'never':147C 'offset':129C 'open':30B,71C 'option':49B,111C,117C,125C,136C,144C,154C 'option-list':143C 'option-typ':124C 'out-of-bound':8A,94C 'packag':25B 'packet':5A 'past':59B 'patch':159C 'peer':42B,89C 'pre':104C 'pre-authent':103C 'prior':80C 'proprietari':47B,116C,153C 'protocol':33B,73C 'read':12A,54B,98C,118C 'remot':40B 'sc':114C 'send':44B 'sourc':31B,72C 'stack':2A,27B,67C,74C 'system':38B,79C 'trigger':91C 'type':126C 'valid':146C 'vendor':121C 'vendor-id':120C 'version':82C,161C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile BACnet Stack into embedded building-automation or device firmware and enable BACnet/SC. Exposure needs a peer that can reach the BACnet/SC service; builds without BACnet/SC can skip it. The sources do not say which products bundle the library.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","medium","package"],"campaign_type":null,"search_a":"'-2026':14A,17A '-58265':15A,18A 'bacnet':1A 'bacnet/sc':4A 'bound':11A 'caus':6A 'cve':13A,16A 'heap':7A 'malform':3A 'out-of-bound':8A 'packet':5A 'read':12A 'stack':2A","search_b":"'3':57B 'authent':65B 'autom':22B 'bacnet':19B,26B,32B 'bacnet/sc':41B 'buffer':62B 'build':21B 'building-autom':20B 'byte':58B 'c':23B,34B 'craft':46B 'decod':53B 'embed':24B,37B 'header':48B 'heap':61B 'librari':35B 'make':51B 'open':30B 'option':49B 'packag':25B 'past':59B 'peer':42B 'proprietari':47B 'protocol':33B 'read':54B 'remot':40B 'send':44B 'sourc':31B 'stack':27B 'system':38B","search_c":"'1.4.5':83C,162C '1.5.1':84C,163C '1.6.0':86C,165C '3':101C,130C '4':131C '5':132C 'authent':105C 'bacnet':66C,70C 'bacnet/sc':88C,108C 'bound':97C 'bvlc':113C 'byte':102C 'c':75C 'check':134C 'declar':138C 'decod':112C,115C 'embed':78C 'enforc':148C 'fix':128C 'header':110C,139C 'header-opt':109C 'heap':93C 'id':122C 'issu':156C 'length':140C,151C 'librari':76C 'list':145C 'minimum':150C 'never':147C 'offset':129C 'open':71C 'option':111C,117C,125C,136C,144C,154C 'option-list':143C 'option-typ':124C 'out-of-bound':94C 'patch':159C 'peer':89C 'pre':104C 'pre-authent':103C 'prior':80C 'proprietari':116C,153C 'protocol':73C 'read':98C,118C 'sc':114C 'sourc':72C 'stack':67C,74C 'system':79C 'trigger':91C 'type':126C 'valid':146C 'vendor':121C 'vendor-id':120C 'version':82C,161C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:05:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58265","severity":null,"published_at":"2026-11-13T16:19:12+00:00","modified_at":"2026-11-13T16:19:12+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147671,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:05:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}