CVE-2026-45265: Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNETATOMICREADFILEDATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bacnet-stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
bacnet-stackto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BACnet Stack server implementations that process Atomic-Read-File requests in record access mode are exposed if they use a version earlier than 1.4.4 or 1.5.1. The vulnerable code path is on the real server side.
What does an attacker need to exploit the vulnerability?
An attacker only needs network access to send a crafted Atomic-Read-File request with an excessively large RecordCount. No privileges or user interaction are required.
What is the impact of a successful exploit?
The crafted RecordCount causes writes beyond a stack-allocated data structure, producing a stack-buffer-overflow. The documented severity is high, with integrity impact rated low and availability impact rated high.
How can this be remediated?
Update BACnet Stack to version 1.4.4 or 1.5.1, which contain the patch for this issue.