{"id":"CVE-2026-58498","kind":"vulnerability","aliases":["CVE-2026-58498"],"related":[],"title":"BACnet Stack: remote buffer overflow in IPv6 router application","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","summary":"BACnet Stack is an open source BACnet protocol C library for embedded systems. A remote attacker can trigger an out-of-bounds write to the global transmit buffer in the router-ipv6 application shipped with it, which can corrupt memory.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet-stack","building-automation","embedded","ipv6","package"],"not_affected_if":["patched-version","router-ipv6-not-used"],"how_to_check":"- Check whether the `router-ipv6` application is built or deployed from bacnet-stack\n- Check the bacnet-stack version in use against the fixed versions below","fix":"- Move to `1.4.5`, `1.5.1`, or `1.6.0` depending on your release line","status":"open","published_at":"2026-11-13T16:19:12+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:21+00:00","updated_at":"2026-11-13T16:48:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T16:48:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.4.5`, `1.5.1`, or `1.6.0` depending on your release line","reach":"network","title":"BACnet Stack: remote buffer overflow in IPv6 router application","impact":"high","summary":"BACnet Stack is an open source BACnet protocol C library for embedded systems. A remote attacker can trigger an out-of-bounds write to the global transmit buffer in the router-ipv6 application shipped with it, which can corrupt memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bacnet-stack","embedded","building-automation","ipv6"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker corrupts memory and may run code on the device","analyst_note":"Confirm the attack vector and whether memory corruption can lead to code execution; check the vendor advisory linked from the GitHub advisory.","how_to_check":"- Check whether the `router-ipv6` application is built or deployed from bacnet-stack\n- Check the bacnet-stack version in use against the fixed versions below","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["router-ipv6-not-used","patched-version"],"who_is_affected":"Only deployments that run the router-ipv6 application from bacnet-stack before the fixed versions are exposed. Systems that do not build or run that application are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4610,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-58498':12A,15A '1.4.5':84C,131C '1.5.1':85C,132C '1.6.0':87C,134C 'applic':9A,59B,102C 'asan':123C 'attack':40B 'autom':21B 'bacnet':1A,17B,25B,31B,67C,71C,106C 'bacnet-stack':16B,105C 'bound':47B,115C 'buffer':4A,53B,94C,121C 'build':20B 'building-autom':19B 'c':33B,76C 'corrupt':65B 'cve':10A,13A 'embed':22B,36B,79C 'global':51B,93C,119C 'global-buffer-overflow':92C 'ipv6':7A,23B,58B,101C 'issu':125C 'librari':34B,77C 'memori':66B 'offici':98C 'open':29B,72C 'out-of-bound':44B,112C 'overflow':5A,95C 'packag':24B 'patch':128C 'prior':81C 'protocol':32B,74C 'remot':3A,39B,91C 'result':109C 'router':8A,57B,100C 'router-ipv6':56B,99C 'ship':60B,103C 'sourc':30B,73C 'stack':2A,18B,26B,68C,75C,107C 'system':37B,80C 'transmit':52B,120C 'trigger':42B 'version':83C,130C 'write':48B,116C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run the router-ipv6 application from bacnet-stack before the fixed versions are exposed. Systems that do not build or run that application are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnetstack","buildingautomation","embedded","high","ipv6","package"],"campaign_type":null,"search_a":"'-2026':11A,14A '-58498':12A,15A 'applic':9A 'bacnet':1A 'buffer':4A 'cve':10A,13A 'ipv6':7A 'overflow':5A 'remot':3A 'router':8A 'stack':2A","search_b":"'applic':59B 'attack':40B 'autom':21B 'bacnet':17B,25B,31B 'bacnet-stack':16B 'bound':47B 'buffer':53B 'build':20B 'building-autom':19B 'c':33B 'corrupt':65B 'embed':22B,36B 'global':51B 'ipv6':23B,58B 'librari':34B 'memori':66B 'open':29B 'out-of-bound':44B 'packag':24B 'protocol':32B 'remot':39B 'router':57B 'router-ipv6':56B 'ship':60B 'sourc':30B 'stack':18B,26B 'system':37B 'transmit':52B 'trigger':42B 'write':48B","search_c":"'1.4.5':84C,131C '1.5.1':85C,132C '1.6.0':87C,134C 'applic':102C 'asan':123C 'bacnet':67C,71C,106C 'bacnet-stack':105C 'bound':115C 'buffer':94C,121C 'c':76C 'embed':79C 'global':93C,119C 'global-buffer-overflow':92C 'ipv6':101C 'issu':125C 'librari':77C 'offici':98C 'open':72C 'out-of-bound':112C 'overflow':95C 'patch':128C 'prior':81C 'protocol':74C 'remot':91C 'result':109C 'router':100C 'router-ipv6':99C 'ship':103C 'sourc':73C 'stack':68C,75C,107C 'system':80C 'transmit':120C 'version':83C,130C 'write':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:05:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58498","severity":null,"published_at":"2026-11-13T16:19:12+00:00","modified_at":"2026-11-13T16:19:12+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null}],"documents":[{"id":147672,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:05:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}