{"id":"CVE-2026-82414","kind":"vulnerability","aliases":["CVE-2026-82414"],"related":[],"title":"BACnet Stack: long MS/TP frame overflows buffer, risking memory corruption","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A long valid COBS-encoded MS/TP frame can be decoded past the end of its fixed input buffer, corrupting memory on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet-stack","building-automation","c","embedded","package"],"not_affected_if":["bacnet-ip-only","versions-outside-range"],"how_to_check":"- Check the bacnet-stack version in the project, for example `git describe --tags` or the version in your build files, and compare against the fixed versions below.\n- Look for the MS/TP receive path (COBS decoding) in your build of the library.","fix":"- `1.4.6` for the 1.4.x line\n- `1.5.1` for the 1.5.x line\n- `1.6.1` for the 1.6.x line\n- `1.7.0` includes the patch","status":"open","published_at":"2026-11-13T19:19:36+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","triaged_at":"2026-11-13T19:54:04+00:00","updated_at":"2026-11-13T19:54:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T19:54:04Z","model":"claude-haiku-5-5","output":{"fix":"- `1.4.6` for the 1.4.x line\n- `1.5.1` for the 1.5.x line\n- `1.6.1` for the 1.6.x line\n- `1.7.0` includes the patch","reach":"network","title":"BACnet Stack: long MS/TP frame overflows buffer, risking memory corruption","impact":"high","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A long valid COBS-encoded MS/TP frame can be decoded past the end of its fixed input buffer, corrupting memory on the device.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet-stack","embedded","building-automation","c"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Memory past the input buffer is overwritten, possibly crashing or running code.","analyst_note":"","how_to_check":"- Check the bacnet-stack version in the project, for example `git describe --tags` or the version in your build files, and compare against the fixed versions below.\n- Look for the MS/TP receive path (COBS decoding) in your build of the library.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["bacnet-ip-only","versions-outside-range"],"who_is_affected":"Applies to BACnet Stack from 1.4.0 before 1.4.6, 1.5.0 before 1.5.1, and 1.6.0 before 1.6.1 when the MS/TP serial receive path is used. Teams running only BACnet/IP, or who do not build the MS/TP receive code into their firmware, are less exposed. Embedded devices on RS-485 MS/TP buses are the main systems to check.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4664,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82414':13A,16A '1.4.0':79C '1.4.6':82C,145C '1.5.0':83C '1.5.1':86C,146C '1.6.0':88C '1.6.1':91C,147C '1.7.0':149C 'actual':135C 'autom':22B,37B 'bacnet':1A,18B,26B,34B,63C,67C,93C 'bacnet-stack':17B 'buffer':7A,57B,109C,116C,137C 'build':21B,33B,36B 'building-autom':20B,35B 'c':23B,30B,72C 'capac':121C 'cob':43B,98C,125C 'cobs-encod':42B 'corrupt':10A,58B 'cve':11A,14A 'decod':49B,97C,120C 'devic':38B,62B 'embed':24B,75C 'encod':44B 'end':52B,132C 'fix':55B,107C 'frame':5A,46B,99C 'full':113C 'input':56B,108C,115C 'input-buff':114C 'insid':104C 'issu':139C 'librari':31B,73C 'long':3A,40B,123C 'memori':9A,59B 'ms/tp':4A,45B,94C 'open':68C 'output':102C 'overflow':6A 'packag':25B 'pass':111C 'past':50B,130C 'patch':142C 'path':96C 'payload':126C 'pointer':103C 'protocol':70C 'receiv':95C 'remain':136C 'risk':8A 'size':117C 'sourc':69C 'stack':2A,19B,27B,64C,71C 'system':76C 'therefor':128C 'valid':41B,124C 'version':78C,144C 'write':129C","nicknames":[],"mitigations":[],"who_affected":"Applies to BACnet Stack from 1.4.0 before 1.4.6, 1.5.0 before 1.5.1, and 1.6.0 before 1.6.1 when the MS/TP serial receive path is used. Teams running only BACnet/IP, or who do not build the MS/TP receive code into their firmware, are less exposed. Embedded devices on RS-485 MS/TP buses are the main systems to check.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnetstack","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':12A,15A '-82414':13A,16A 'bacnet':1A 'buffer':7A 'corrupt':10A 'cve':11A,14A 'frame':5A 'long':3A 'memori':9A 'ms/tp':4A 'overflow':6A 'risk':8A 'stack':2A","search_b":"'autom':22B,37B 'bacnet':18B,26B,34B 'bacnet-stack':17B 'buffer':57B 'build':21B,33B,36B 'building-autom':20B,35B 'c':23B,30B 'cob':43B 'cobs-encod':42B 'corrupt':58B 'decod':49B 'devic':38B,62B 'embed':24B 'encod':44B 'end':52B 'fix':55B 'frame':46B 'input':56B 'librari':31B 'long':40B 'memori':59B 'ms/tp':45B 'packag':25B 'past':50B 'stack':19B,27B 'valid':41B","search_c":"'1.4.0':79C '1.4.6':82C,145C '1.5.0':83C '1.5.1':86C,146C '1.6.0':88C '1.6.1':91C,147C '1.7.0':149C 'actual':135C 'bacnet':63C,67C,93C 'buffer':109C,116C,137C 'c':72C 'capac':121C 'cob':98C,125C 'decod':97C,120C 'embed':75C 'end':132C 'fix':107C 'frame':99C 'full':113C 'input':108C,115C 'input-buff':114C 'insid':104C 'issu':139C 'librari':73C 'long':123C 'ms/tp':94C 'open':68C 'output':102C 'pass':111C 'past':130C 'patch':142C 'path':96C 'payload':126C 'pointer':103C 'protocol':70C 'receiv':95C 'remain':136C 'size':117C 'sourc':69C 'stack':64C,71C 'system':76C 'therefor':128C 'valid':124C 'version':78C,144C 'write':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T10:39:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82414","severity":null,"published_at":"2026-11-13T19:19:36+00:00","modified_at":"2026-11-13T19:19:36+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":149175,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T10:39:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}