CVE-2026-47259 in BACnet Stack
Summary
by MITRE • 11/12/2026
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/12/2026
The BACnet Stack is a widely utilized open-source C library designed to implement the Building Automation and Control Networks protocol for embedded systems. This stack facilitates communication between various devices within industrial control environments, such as HVAC systems, lighting controls, and access management hardware. A critical security flaw was identified in versions prior to 1.4.4, 1.5.1, and 1.6.0 of this library, specifically affecting the handling of notification class recipient lists. The vulnerability arises during the processing of a RemoveListElement request directed at the Notification-Class.recipient-list attribute. This specific BACnet service is intended to remove entries from an existing list of recipients designated for notifications, such as alarms or status changes.
The technical root cause of this vulnerability is a stack-based out-of-bounds write condition triggered by malformed input data. When a RemoveListElement request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements, the library fails to adequately validate the bounds of the destination array before performing memory operations. This lack of proper boundary checking allows an attacker to overwrite adjacent stack memory with arbitrary data derived from the excessive number of destinations provided in the malicious packet. In C-based embedded systems, where manual memory management is prevalent and buffer overflows are a common attack vector, such out-of-bounds writes can lead to severe consequences including application crashes, corruption of critical system state variables, or potentially remote code execution if an attacker can control the content written beyond the stack boundary.
From an operational perspective, this vulnerability poses significant risks to building automation systems that rely on BACnet for their core functionality. An attacker with network access to a vulnerable device could exploit this flaw by sending specially crafted RemoveListElement requests over the BACnet/IP or other supported transport layers. Successful exploitation may result in denial of service conditions where the affected device becomes unresponsive due to stack corruption, disrupting critical building operations such as climate control or security monitoring. In more sophisticated attack scenarios, if the memory layout allows for it and additional vulnerabilities exist, this out-of-bounds write could be leveraged to execute arbitrary code on the embedded controller, potentially granting an attacker full control over the physical infrastructure managed by that device.
This vulnerability is classified under CWE-121, which denotes a stack-based buffer overflow, as well as CWE-787, indicating an out-of-bounds write. In terms of adversary tactics and techniques, this exploitation aligns with ATT&CK technique T1059, Command and Scripting Interpreter, if code execution is achieved, or more broadly with initial access vectors that target network services exposed to untrusted networks. The vulnerability highlights the importance of rigorous input validation in embedded protocol implementations, particularly when handling list-based operations where limits are defined by system constants like NC_MAX_RECIPIENTS.
Mitigation for this issue involves upgrading the BACnet Stack library to version 1.4.4, 1.5.1, or 1.6.0 and later, as these versions contain patches that properly validate input lengths against maximum recipient limits before processing RemoveListElement requests. Organizations should also implement network segmentation strategies to restrict access to BACnet devices from untrusted networks, ensuring that only authorized management stations can send configuration changes or list modifications. Additionally, deploying intrusion detection systems capable of identifying anomalous BACnet traffic patterns may provide an additional layer of defense against exploitation attempts while updates are being applied across the infrastructure.