{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":">= 1.4.0, < 1.4.6"},{"status":"affected","version":">= 1.5.0, < 1.5.1"},{"status":"affected","version":">= 1.6.0, < 1.6.1"}]}],"cveId":"CVE-2026-82414","cwes":["CWE-787"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794595231749,"publishedAt":1794595231749,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1425"}],"remediation":[],"revision":"b4709e9cc645aa7f989d2e0895cdcc9f9bab596e5382fa48b1680008c9739923","sources":[{"modifiedAt":1794595231749,"name":"CNA: GitHub_M","retrievedAt":1794597979037,"url":"https://www.cve.org/CVERecord?id=CVE-2026-82414"}],"ssvc":null,"status":"published","title":"BACnet Stack: MS/TP COBS decode overflow","updatedAt":1794597979037}