Out-of-Bounds Write Vulnerability in BACnet Stack by BACnet
CVE-2026-52788

8.8HIGH

Key Information:

Vendor

Bacnet-stack

Status
Bacnet-stack
Vendor
CVE Published:
13 November 2026

What is CVE-2026-52788?

BACnet Stack, an open-source BACnet protocol library for embedded systems, contains vulnerabilities prior to versions 1.4.5, 1.5.1, and 1.6.0. The issue arises in the bsc_node_parse_urls() function, which improperly parses space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Specifically, two separate bugs lead to out-of-bounds writes beyond the confines of the static BSC_ADDRESS_RESOLUTION structure's utf8_urls[10][129] array, potentially compromising system integrity. The issue has been addressed in the latest versions.

Affected Version(s)

bacnet-stack < 1.4.5 < 1.4.5

bacnet-stack < 1.5.1 < 1.5.1

bacnet-stack < 1.6.0 < 1.6.0

References

https://github.com/bacnet-stack/bacnet-stack/security/adv...
x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/pull/1365
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.