BACnet Stack - CraftedSignal Threat Feed

BACnet Stack: Remote Denial of Service (CVE-2026-47711)

hello@craftedsignal.io — Thu, 12 Nov 2026 20:53:21 +0000

The BACnet Stack C library contains a vulnerability (CVE-2026-47711) affecting the master demo server. A remote actor can cause the server to crash over BACnet/IP by sending a Confirmed WriteProperty request that updates 'loop-1's controlled-variable-reference' to 'life-safety-zone-1 / accepted-modes'.

Impact

Successful exploitation results in a remote denial of service of the BACnet master demo server instance.

Recommendation

Review the vendor documentation for patch availability and recommended updates.

BACnet Stack: Stack-based buffer overflow in Loop object processing (CVE-2026-47710)

hello@craftedsignal.io — Thu, 12 Nov 2026 20:53:13 +0000

BACnet Stack is an open source C library for embedded systems. A stack-buffer-overflow exists in the master branch when a Loop object reads a referenced property through its default timer path, specifically when a referenced OBJECT_STRUCTURED_VIEW / PROP_DESCRIPTION contains a long string.

Impact

The vulnerability is rated with a CVSS v3.1 base score of 8.2.

Recommendation

Refer to the official project repository for information regarding the vulnerability.