CVE-2026-97692 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for building BACnet building-automation devices. A single crafted BACnet/SC frame makes the header-option decoder read and write past its buffers, and an attacker reaches it before authenticating.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only deployments that compile BACnet/SC support from BACnet Stack and expose it to a network are exposed, and the flaw is reachable before any login. Devices using older BACnet/IP or other BACnet transports without SC are not described as affected. Teams that only use patched versions or do not ship this library can skip it.
Not affected if bacnet-sc-disabled, patched-version
Who cares bacnet, bacnet-sc, building-automation, c, embedded
bacnet-stack library in your build (for example grep -ri bacnet in your dependency manifests or vendored sources)bacnet-stack 1.4.6, 1.5.2, 1.6.1, or 1.7.0 (the fixed versions named in the description; upgrade to the one on your release line)BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.