Bacnetstack · product
Bacnet Stack
42 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 42 is a mark on the map. Named now: 1 to 26, most at risk first.
- BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c.
- BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
- BACnet-stack MS/TP reply matcher OOB read
- BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
- BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount
- BACnet Stack Improperly Limits Pathnames to a Restricted Directory
- BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
- BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
- BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success
- BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server
- BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
- BACnet Stack: NULL pointer dereference in bacnet_device_object_reference_decode() when WriteProperty updates Structured View subordinate-list
- BACnet Stack: Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information Disclosure
- The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string
- BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding
- Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack
- BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow
- BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding
- BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`
- BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()
- BACnet Stack: Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData[] Mismatch
- BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory
- BACnet Stack: MS/TP COBS decode overflow
- BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
- BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`
- BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP