CVE-2026-62974 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is an open source BACnet protocol library in C used in embedded building-automation devices. A malformed but non-empty WriteProperty request can put the official server demo into a non-terminating loop that consumes memory, so the device stops responding.
first public Jul 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that compile BACnet Stack into a BACnet server or device, especially the official server demo, where unauthenticated network clients can send WriteProperty requests. Systems that only use BACnet Stack as a client, or that do not expose BACnet to untrusted networks, are less exposed; the sources do not say more.
Not affected if client-only, not-network-exposed
Who cares bacnet, building-automation, c, embedded
1.4.5, 1.5.1, and 1.6.0.1.4.5, 1.5.1, or 1.6.0 depending on your release line.BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.