Bacnetstack · weakness class
Memory Corruption
31 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 31 is a mark on the map. Named now: 1 to 26, most at risk first.
- BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c.
- BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory
- BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
- BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
- BACnet-stack MS/TP reply matcher OOB read
- BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
- BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
- BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties
- BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount
- BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
- BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
- BACnet Stack: MS/TP COBS decode overflow
- BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends
- BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()
- BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
- BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
- BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
- BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)
- BACnet Stack: NULL pointer dereference in bacnet_device_object_reference_decode() when WriteProperty updates Structured View subordinate-list
- BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)
- BACnet Stack: Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information Disclosure
- The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string
- BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read
- BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding
- Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack
- BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.