CVE-2026-47259
Received Received - Intake

Stack-based Out-of-Bounds Write in BACnet Stack

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-47259
EUVD
EUVD-2026-124665

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47259 is a stack-based buffer overflow in the BACnet protocol stack. It occurs when a RemoveListElement request contains more than 10 valid BACnetDestination elements. The function decodes these elements into a fixed-size stack array without bounds checking, causing an out-of-bounds write when the 11th element is processed. This leads to a remote crash or denial of service.

Detection Guidance

Detecting this vulnerability requires checking the version of the BACnet Stack library in use. If your system runs versions up to 1.6.0-rc1, it may be vulnerable. Inspect installed packages or binaries linked to bacnet-stack. Network monitoring tools can detect malformed RemoveListElement requests targeting Notification-Class.recipient-list with more than 10 BACnetDestination elements.

Impact Analysis

This vulnerability allows remote attackers to crash the BACnet stack by sending a maliciously crafted RemoveListElement request. The crash results in a denial of service, disrupting the availability of systems using affected versions of the bacnet-stack library.

Mitigation Strategies

Upgrade the BACnet Stack library to versions 1.4.4, 1.5.1, or 1.6.0 or later. If upgrading is not immediately possible, restrict network access to BACnet services or implement deep packet inspection to block malformed RemoveListElement requests with excessive BACnetDestination elements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...