CVE-2026-52786

HIGH

MEDIUM Priority: 0.02 BB Relevance: 64/100

Published: 2026-11-12 Modified: 2026-11-12 First seen: 2026-11-12 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: Required

S: Unchanged

C: None

I: Low

A: High

Description

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.