bacnet-stack BACnet Stack up to 1.4.5/1.5.1/1.6.0 BACnet/SC Message Decoder out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, has been found in bacnet-stack BACnet Stack up to 1.4.5/1.5.1/1.6.0. This affects an unknown part of the component BACnet/SC Message Decoder. This manipulation causes out-of-bounds write. This vulnerability appears as CVE-2026-97692. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in bacnet-stack BACnet Stack up to 1.4.5/1.5.1/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component BACnet/SC Message Decoder. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-97692 since 09/24/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.4.6, 1.5.2, 1.6.1 or 1.7.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• bacnet-stack

Name

• BACnet Stack

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.5
• 1.5.0
• 1.5.1
• 1.6.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion