CVE-2026-82414 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for building BACnet building-automation devices. A long valid COBS-encoded MS/TP frame can be decoded past the end of its fixed input buffer, corrupting memory on the device.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applies to BACnet Stack from 1.4.0 before 1.4.6, 1.5.0 before 1.5.1, and 1.6.0 before 1.6.1 when the MS/TP serial receive path is used. Teams running only BACnet/IP, or who do not build the MS/TP receive code into their firmware, are less exposed. Embedded devices on RS-485 MS/TP buses are the main systems to check.
Not affected if bacnet-ip-only, versions-outside-range
Who cares bacnet-stack, building-automation, c, embedded
git describe --tags or the version in your build files, and compare against the fixed versions below.1.4.6 for the 1.4.x line1.5.1 for the 1.5.x line1.6.1 for the 1.6.x line1.7.0 includes the patchBACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.