CVE-2026-52788

Name of the Vulnerable Software and Affected Versions BACnet Stack versions prior to 1.4.5 BACnet Stack versions prior to 1.5.1 BACnet Stack versions prior to 1.6.0

Description The bsc node parse urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three bugs triggered when parsing space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Two of these bugs lead to out-of-bounds writes beyond the utf8 urls[10][129] array within the static BSC ADDRESS RESOLUTION structure.

Recommendations Update to version 1.4.5. Update to version 1.5.1. Update to version 1.6.0.