Stack-Buffer-Overflow in BACnet Stack Library

Executive Summary

CVE-2026-47710 is a stack-buffer-overflow vulnerability in the BACnet Stack library. It occurs when a Loop object reads a referenced property like OBJECT_STRUCTURED_VIEW or PROP_DESCRIPTION containing a long attacker-controlled string through its default timer path. The issue arises because the Loop object uses a fixed 32-byte stack buffer to read the property, which overflows when the string is too long. This flaw was patched in versions 1.4.4, 1.5.1, and 1.6.0.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in BACnet devices using vulnerable versions of bacnet-stack. Check for repeated crashes in BACnet/IP devices, especially during Device_Timer processing. Inspect logs for stack overflow errors or memory corruption messages. Use network monitoring tools to detect malformed BACnet packets targeting Loop objects with large Structured View descriptions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a remote unauthenticated denial of service (DoS) attack. An attacker can crash the BACnet server by sending two valid WriteProperty requests to set a long string in a Structured View description and then referencing it in a Loop object. The server crashes during normal processing due to memory corruption from the buffer overflow.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to patched versions (1.4.4, 1.5.1, or 1.6.0) immediately. If upgrading is not possible, implement input validation to reject long strings in OBJECT_STRUCTURED_VIEW/PROP_DESCRIPTION properties. Disable Loop objects if unused. Apply network segmentation to limit BACnet traffic exposure. Monitor for exploitation attempts targeting Loop object references.

Useful 0 Not Useful 0