# CVE-2026-47710: BACnet Stack stack-buffer-overflow in Loop object property read

Source: https://junglewise.ai/threats/cve-2026-47710-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-47710 · Severity: high · CVSS 8.2 · Published 2026-11-12

BACnet Stack is an open-source C library that implements the BACnet building automation protocol for embedded systems. A stack-buffer-overflow vulnerability in the Loop object can be triggered remotely when it reads a long attacker-controlled string from a referenced property, causing memory corruption and denial of service of the server.

Technologies: [BACnet Stack Project BACnet Stack](https://junglewise.ai/threats/technologies/bacnet-stack). Vendors: [BACnet Stack Project](https://junglewise.ai/threats/vendors/bacnet-stack-project).

## Quick answers

**Is CVE-2026-47710 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47710 being exploited in the wild.

**How severe is CVE-2026-47710?** High severity, with a CVSS score of 8.2, published 12 November 2026.

**Which products and versions are affected?** BACnet Stack Project BACnet Stack prior to 1.4.4, 1.5.1, and 1.6.0.

**Is there a fix for CVE-2026-47710?** Yes: fixed in 1.4.4, 1.5.1, 1.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47710 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47710?** Check whether you run BACnet Stack Project BACnet Stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.4, 1.5.1, 1.6.0

## Technical details

A stack-buffer-overflow occurs in Loop_Read_Variable_Reference_Update() which reads any referenced property into a fixed 32-byte APDU buffer without validating the referenced property type or size. An attacker can write a long string to a Structured View object's description property via WriteProperty, then point a Loop object's controlled-variable-reference to that property; when the Loop timer fires and reads the referenced property, the oversized string overflows the 32-byte buffer, causing memory corruption and crash.

## Affected products

- BACnet Stack Project BACnet Stack prior to 1.4.4, 1.5.1, and 1.6.0

## Timeline

- 2026-07-05: disclosed
- 2026-05-19: patched

## References

- [https://github.com/bacnet-stack/bacnet-stack/pull/1355](https://github.com/bacnet-stack/bacnet-stack/pull/1355)
- [https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2xm5-gjpc-9m6q](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2xm5-gjpc-9m6q)

## Related threats

- [BACnet Stack out-of-bounds read in AtomicWriteFile](https://junglewise.ai/threats/cve-2026-46674-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack out-of-bounds read in bacnet_tag_number_decode](https://junglewise.ai/threats/cve-2026-38570-bacnet-stack-out-of-bounds-read-in-bacnet-tag-number-decode)