CVE-2026-97692
Received Received - Intake

Heap-based Buffer Overflow in BACnet Stack

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-97692
EUVD
EUVD-2026-125696

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the BACnet Stack library, which is used for BACnet/SC protocol communication in embedded systems. The issue occurs in the message decoder where a crafted frame can cause the decoder to read and write memory outside the intended bounds. Specifically, the decoder follows the MORE bit in message options without proper bounds checking, leading to out-of-bounds reads and writes. This can corrupt adjacent memory, including a static global array used for decoding options.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service by sending a specially crafted message to a vulnerable BACnet/SC server. Since the issue is reachable before authentication and from the first frame sent, it poses a significant risk for systems using unpatched versions of the BACnet Stack library. The impact includes potential system compromise or disruption of service.

Mitigation Strategies

Update the BACnet Stack library to version 1.4.6, 1.5.2, 1.6.1, or 1.7.0 or later to patch the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...