CVE-2026-52786

Name of the Vulnerable Software and Affected Versions BACnet Stack versions prior to 1.4.5 BACnet Stack versions prior to 1.5.1 BACnet Stack versions prior to 1.6.0

Description The official apps/epics client tool contains a global-buffer-overflow in the response-processing path. A malicious BACnet/IP endpoint can respond to a legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK containing more heading properties than the tool's fixed local storage can accommodate. The ProcessRPMData() function then writes property values into a fixed global array using an unbounded linear index, leading to network-reachable memory corruption. This occurs because the tool treats a remotely supplied variable-length RPM property list as a trusted, fixed-size local heading-property set.

Recommendations Update to version 1.4.5. Update to version 1.5.1. Update to version 1.6.0.