CVE-2026-46677: BACnet Stack: Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData[] Mismatch
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNETATOMICREADFILEDATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
BACnet Stackto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using BACnet Stack versions earlier than 1.4.4 or 1.5.1 are affected if they process AtomicReadFile-ACK responses using the record-access handling path. The vulnerable code is client-side, so systems acting as AtomicReadFile clients are the relevant exposure.
What does an attacker need to do to trigger the out-of-bounds read?
An attacker needs to cause the client to process an AtomicReadFile-ACK with a returnedRecordCount larger than the local fileData[] capacity. The malformed or oversized count is retained even when excess records are not stored, and a later consumer iterates using that original count.
Is authentication required to exploit this vulnerability?
No privileges or authentication are required according to the CVSS vector. Exploitation does require user interaction and network access.
What versions contain the fix?
The issue is patched in BACnet Stack versions 1.4.4 and 1.5.1. Updating to the applicable patched release removes the vulnerable behavior.