CVE-2026-46674: BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNETATOMICWRITEFILEDATA. This issue has been patched in versions 1.4.4 and 1.5.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the BACnet Stack C library before version 1.4.4 or 1.5.1 are affected if they use the AtomicWriteFile record-access path.
What does an attacker need to exploit this issue?
The vulnerability is network-accessible, requires no privileges or user interaction, and involves external control of the returnedRecordCount field processed by the AtomicWriteFile record decoder.
What is the impact of successful exploitation?
Successful exploitation can cause an out-of-bounds read and affect availability. The supplied severity vector indicates no confidentiality or integrity impact.
How should affected systems be remediated?
Upgrade BACnet Stack to version 1.4.4 or 1.5.1, which include the patch for this issue.