{"id":"CVE-2026-97692","kind":"vulnerability","aliases":["CVE-2026-97692"],"related":[],"title":"BACnet Stack: crafted BACnet/SC frame overflows memory before authentication","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A single crafted BACnet/SC frame makes the header-option decoder read and write past its buffers, and an attacker reaches it before authenticating.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","bacnet-sc","building-automation","c","embedded","package"],"not_affected_if":["bacnet-sc-disabled","patched-version"],"how_to_check":"- Look for the `bacnet-stack` library in your build (for example `grep -ri bacnet` in your dependency manifests or vendored sources)\n- Check the library version against the fixed versions below\n- Confirm whether BACnet/SC (secure connect) support is compiled in and reachable from the network: unknown","fix":"- `bacnet-stack` `1.4.6`, `1.5.2`, `1.6.1`, or `1.7.0` (the fixed versions named in the description; upgrade to the one on your release line)","status":"open","published_at":"2026-11-13T19:20:03+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","triaged_at":"2026-11-13T19:54:09+00:00","updated_at":"2026-11-13T19:54:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T19:54:09Z","model":"claude-haiku-5-5","output":{"fix":"- `bacnet-stack` `1.4.6`, `1.5.2`, `1.6.1`, or `1.7.0` (the fixed versions named in the description; upgrade to the one on your release line)","reach":"network","title":"BACnet Stack: crafted BACnet/SC frame overflows memory before authentication","impact":"high","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A single crafted BACnet/SC frame makes the header-option decoder read and write past its buffers, and an attacker reaches it before authenticating.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bacnet","bacnet-sc","embedded","building-automation","c"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code or corrupts memory on the BACnet server","analyst_note":"Confirm the exact affected version range and whether BACnet/SC is enabled by default, using the vendor advisory linked from the GitHub advisory.","how_to_check":"- Look for the `bacnet-stack` library in your build (for example `grep -ri bacnet` in your dependency manifests or vendored sources)\n- Check the library version against the fixed versions below\n- Confirm whether BACnet/SC (secure connect) support is compiled in and reachable from the network: unknown","plain_action":"","product_name":"bacnet-stack","needs_analyst":true,"not_affected_if":["bacnet-sc-disabled","patched-version"],"who_is_affected":"Only deployments that compile BACnet/SC support from BACnet Stack and expose it to a network are exposed, and the flaw is reachable before any login. Devices using older BACnet/IP or other BACnet transports without SC are not described as affected. Teams that only use patched versions or do not ship this library can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000824,"input_tokens":4828,"output_tokens":682,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-97692':12A,15A '1.4.6':80C,254C '1.5.2':81C,255C '1.6.1':83C,256C '1.7.0':258C '4':179C 'adjac':212C 'advanc':138C 'array':182C,196C 'attack':58B 'authent':9A,62B,219C 'autom':22B,37B 'bacnet':1A,16B,18B,26B,34B,63C,67C 'bacnet-sc':17B 'bacnet/sc':4A,42B,85C,229C 'bit':100C,112C 'bound':121C,156C,190C,208C 'bsc':201C 'bss':213C 'buffer':55B 'build':21B,33B,36B 'building-autom':20B,35B 'bvlc':132C 'bvlc-sc':131C 'byte':153C,159C,233C 'c':23B,30B,72C 'carri':163C 'connect':230C 'craft':3A,41B,130C 'cve':10A,13A 'data':246C 'decod':49B,87C,116C,185C,195C 'devic':38B 'dm':202C 'embed':24B,75C 'end':143C 'entri':180C 'fault':215C 'field':187C 'first':222C 'fix':178C 'follow':95C,235C 'frame':5A,43B,134C,223C,245C 'global':200C 'go':173C 'header':47B,91C 'header-opt':46B,90C 'issu':248C 'keep':172C 'land':210C 'last':106C 'len':151C 'librari':31B,73C 'list':93C,104C 'make':44B,135C 'mani':124C 'marker':169C 'memori':7A 'messag':86C,146C,149C,150C,162C,237C 'more-set':165C 'noth':101C 'one':139C,152C 'open':68C 'option':48B,92C,97C,107C,125C,140C,168C,181C,186C 'out-of-bound':205C 'overflow':6A 'packag':25B 'past':53B,141C,176C 'patch':251C 'peer':225C,241C 'prior':77C,244C 'prior-fram':243C 'process':127C 'protocol':70C 'reach':59B 'reachabl':217C 'read':50B,148C 'reject':102C 'run':175C 'sc':19B,133C 'send':226C 'server':193C 'set':113C,167C 'singl':40B,129C 'sourc':69C 'stack':2A,27B,64C,71C 'static':199C 'still':108C 'system':76C 'upper':120C 'version':79C,253C 'walk':88C,117C,137C,171C 'whose':105C 'write':52B,184C,209C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that compile BACnet/SC support from BACnet Stack and expose it to a network are exposed, and the flaw is reachable before any login. Devices using older BACnet/IP or other BACnet transports without SC are not described as affected. Teams that only use patched versions or do not ship this library can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","bacnetsc","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':11A,14A '-97692':12A,15A 'authent':9A 'bacnet':1A 'bacnet/sc':4A 'craft':3A 'cve':10A,13A 'frame':5A 'memori':7A 'overflow':6A 'stack':2A","search_b":"'attack':58B 'authent':62B 'autom':22B,37B 'bacnet':16B,18B,26B,34B 'bacnet-sc':17B 'bacnet/sc':42B 'buffer':55B 'build':21B,33B,36B 'building-autom':20B,35B 'c':23B,30B 'craft':41B 'decod':49B 'devic':38B 'embed':24B 'frame':43B 'header':47B 'header-opt':46B 'librari':31B 'make':44B 'option':48B 'packag':25B 'past':53B 'reach':59B 'read':50B 'sc':19B 'singl':40B 'stack':27B 'write':52B","search_c":"'1.4.6':80C,254C '1.5.2':81C,255C '1.6.1':83C,256C '1.7.0':258C '4':179C 'adjac':212C 'advanc':138C 'array':182C,196C 'authent':219C 'bacnet':63C,67C 'bacnet/sc':85C,229C 'bit':100C,112C 'bound':121C,156C,190C,208C 'bsc':201C 'bss':213C 'bvlc':132C 'bvlc-sc':131C 'byte':153C,159C,233C 'c':72C 'carri':163C 'connect':230C 'craft':130C 'data':246C 'decod':87C,116C,185C,195C 'dm':202C 'embed':75C 'end':143C 'entri':180C 'fault':215C 'field':187C 'first':222C 'fix':178C 'follow':95C,235C 'frame':134C,223C,245C 'global':200C 'go':173C 'header':91C 'header-opt':90C 'issu':248C 'keep':172C 'land':210C 'last':106C 'len':151C 'librari':73C 'list':93C,104C 'make':135C 'mani':124C 'marker':169C 'messag':86C,146C,149C,150C,162C,237C 'more-set':165C 'noth':101C 'one':139C,152C 'open':68C 'option':92C,97C,107C,125C,140C,168C,181C,186C 'out-of-bound':205C 'past':141C,176C 'patch':251C 'peer':225C,241C 'prior':77C,244C 'prior-fram':243C 'process':127C 'protocol':70C 'reachabl':217C 'read':148C 'reject':102C 'run':175C 'sc':133C 'send':226C 'server':193C 'set':113C,167C 'singl':129C 'sourc':69C 'stack':64C,71C 'static':199C 'still':108C 'system':76C 'upper':120C 'version':79C,253C 'walk':88C,117C,137C,171C 'whose':105C 'write':184C,209C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T10:40:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97692","severity":null,"published_at":"2026-11-13T19:20:03+00:00","modified_at":"2026-11-13T19:20:03+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":149176,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-gr74-333w-7wg8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T10:40:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}