CVE-2026-58265
Received Received - Intake

BaseFortify

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-58265
EUVD
EUVD-2026-125538

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read issue in the BACnet Stack library versions prior to 1.4.5, 1.5.1, and 1.6.0. A BACnet/SC peer can exploit this by sending a malformed header-option that causes the decoder to read up to 3 bytes beyond the allocated memory before validating the option's length. The issue occurs in the proprietary option decoder function.

Detection Guidance

This vulnerability involves a heap out-of-bounds read in BACnet/SC header-option decoder. Detection requires checking the BACnet Stack library version. Use commands like 'dpkg -l | grep bacnet' or 'rpm -qa | grep bacnet' to identify installed versions. Compare against patched versions (1.4.5, 1.5.1, 1.6.0). Network detection may involve monitoring BACnet/SC traffic for malformed proprietary options.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data from the affected system, potentially leading to information disclosure. It may cause crashes or instability in the BACnet/SC service due to memory corruption. The impact is pre-authentication, meaning it can be exploited without any prior authentication.

Mitigation Strategies

Immediately upgrade the BACnet Stack library to the latest patched version (1.4.5, 1.5.1, or 1.6.0). If upgrading is not possible, restrict network access to BACnet/SC peers until patches are applied. Monitor vendor advisories for additional guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58265. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...