Out-of-Bounds Write Vulnerability in BACnet Stack by BACnet

CVE-2026-52787

What is CVE-2026-52787?

BACnet Stack, an open-source BACnet protocol library for embedded systems, contains a vulnerability that allows a reachable out-of-bounds write when encoding the device.address-binding property. This flaw, which can lead to potential exploitation, has been addressed in subsequent releases. Users are advised to upgrade to version 1.4.5, 1.5.1, or 1.6.0-rc2 to mitigate the risk. For more details, refer to the security advisory and pull request on GitHub.

References