{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"cveId":"CVE-2026-47711","cwes":["CWE-121","CWE-131","CWE-787","CWE-805"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"}],"modifiedAt":1794513920110,"publishedAt":1794513920110,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-vrpm-9gm2-x552"}],"remediation":[],"revision":"d6b5958102b4d6e65c97d9a444888bc9de88418fcc7a998abe45c47cb915d77e","sources":[{"modifiedAt":1794513920110,"name":"CNA: GitHub_M","retrievedAt":1794517809142,"url":"https://www.cve.org/CVERecord?id=CVE-2026-47711"}],"ssvc":null,"status":"published","title":"BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server","updatedAt":1794517809142}