# CVE-2026-52786: BACnet Stack buffer overflow in EPICS app

Source: https://junglewise.ai/threats/cve-2026-52786-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-52786 · Severity: high · CVSS 7.1 · Published 2026-11-12

BACnet Stack is an open-source protocol library used in building automation and industrial control systems. The official EPICS client tool contains a buffer overflow vulnerability that allows a malicious network endpoint to crash the application or potentially execute arbitrary code by sending a crafted BACnet response message.

Technologies: [BACnet Stack](https://junglewise.ai/threats/technologies/bacnet-stack-bacnet-stack). Vendors: [BACnet Stack](https://junglewise.ai/threats/vendors/bacnet-stack).

## Quick answers

**Is CVE-2026-52786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52786 being exploited in the wild.

**How severe is CVE-2026-52786?** High severity, with a CVSS score of 7.1, published 12 November 2026.

**Which products and versions are affected?** BACnet Stack before 1.4.5, 1.5.1, and 1.6.0.

**Is there a fix for CVE-2026-52786?** Yes: fixed in 1.4.5, 1.5.1, 1.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52786 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52786?** Check whether you run BACnet Stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.5, 1.5.1, 1.6.0

## Technical details

The vulnerability is a global buffer overflow in apps/epics/main.c's ProcessRPMData() function. When processing a ReadPropertyMultiple-ACK response, the application uses an unbounded linear index to write property values into a fixed-size array without validating the remote response count against local storage capacity. The attack requires network connectivity to the EPICS tool and no authentication.

## Affected products

- BACnet Stack BACnet Stack before 1.4.5, 1.5.1, and 1.6.0

## Timeline

- 2026-11-12: disclosed
- 2026-05-29: patched: Fix merged in PR #1366

## References

- [https://github.com/bacnet-stack/bacnet-stack/pull/1366](https://github.com/bacnet-stack/bacnet-stack/pull/1366)
- [https://github.com/bacnet-stack/bacnet-stack/pull/1409](https://github.com/bacnet-stack/bacnet-stack/pull/1409)

## Related threats

- [BACnet Stack stack buffer overflow in life-safety-zone property read](https://junglewise.ai/threats/cve-2026-47711-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack stack-based buffer overflow in RemoveListElement](https://junglewise.ai/threats/cve-2026-47259-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack stack-based buffer overflow in Notification Class AddListElement](https://junglewise.ai/threats/cve-2026-47258-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack restore logic flaw causes data loss](https://junglewise.ai/threats/cve-2026-47257-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack uncontrolled recursion in Channel object](https://junglewise.ai/threats/cve-2026-47217-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)