BACnet Stack Buffer Overflow in EPICS Tool Affects Open Source Embedded Systems
CVE-2026-52786
7.1HIGH
What is CVE-2026-52786?
The BACnet Stack's EPICS tool contains a buffer overflow vulnerability that could be exploited via malicious BACnet/IP endpoints. When a crafted ReadPropertyMultiple request is sent, it can trigger a response with more heading properties than the tool's fixed local storage can process. This design flaw leads to unbounded writes to a global array, potentially resulting in memory corruption. The vulnerability, affecting versions prior to 1.4.5, 1.5.1, and 1.6.0, has been patched to prevent such exploitation.
Affected Version(s)
bacnet-stack < 1.4.5 < 1.4.5
bacnet-stack < 1.5.1 < 1.5.1
bacnet-stack < 1.6.0 < 1.6.0