{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0-rc2"}]}],"cveId":"CVE-2026-52787","cwes":["CWE-131","CWE-787"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794585291243,"publishedAt":1794585291243,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1363"}],"remediation":[],"revision":"a2170f4c661fec5f1fb2b84b29c630cffc4d15220af4d542f25a2f740ec3d317","sources":[{"modifiedAt":1794585291243,"name":"CNA: GitHub_M","retrievedAt":1794586285213,"url":"https://www.cve.org/CVERecord?id=CVE-2026-52787"}],"ssvc":null,"status":"published","title":"BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()","updatedAt":1794586285213}