Stack-based Out-of-Bounds Write in BACnet Stack for Embedded Systems

CVE-2026-47259

What is CVE-2026-47259?

A stack-based out-of-bounds write vulnerability exists in BACnet Stack, an open-source protocol stack library for embedded systems. This issue arises when a RemoveListElement request is made to the Notification-Class.recipient-list, which can cause unexpected behavior if the request exceeds the limit of NC_MAX_RECIPIENTS valid BACnetDestination elements. The vulnerability has been addressed in versions 1.4.4, 1.5.1, and 1.6.0, and users are encouraged to update to these versions to mitigate the risk of exploitation.

References