CVE-2026-49990: BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends

Q: Which deployments are exposed to this issue?

Deployments using BACnet Stack versions 1.4.2 through before 1.4.5, or version 1.5.0 through before 1.5.1, are affected when AtomicReadFile or AtomicWriteFile stream-access requests reach RAM file backends.

Q: What does an attacker need to exploit it?

An attacker needs to send an AtomicReadFile or AtomicWriteFile stream-access request with a signed fileStartPosition value that is insufficiently validated. The provided vector indicates network access is sufficient, with no privileges or user interaction required.

Q: What can exploitation cause?

Exploitation can reliably crash the process, read memory adjacent to the RAM file buffer, or write out of bounds and corrupt heap memory. The resulting corruption can destabilize the process.

Q: How should affected systems be remediated?

Upgrade the 1.4.x branch to version 1.4.5 or later, or upgrade the 1.5.x branch to version 1.5.1 or later. These are the versions identified as containing the patch.

Published Nov 13, 2026

Updated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.

Affected Software

1 affected component

BACnet Stack BACnet Stack>=1.4.2<1.4.5, >=1.5.0<1.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1

Event History

Nov 13, 2026

CVE Published

via MITRE·03:54 PM

Data Sourced

via MITRE·03:54 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using BACnet Stack versions 1.4.2 through before 1.4.5, or version 1.5.0 through before 1.5.1, are affected when AtomicReadFile or AtomicWriteFile stream-access requests reach RAM file backends.

What does an attacker need to exploit it?

An attacker needs to send an AtomicReadFile or AtomicWriteFile stream-access request with a signed fileStartPosition value that is insufficiently validated. The provided vector indicates network access is sufficient, with no privileges or user interaction required.

What can exploitation cause?

Exploitation can reliably crash the process, read memory adjacent to the RAM file buffer, or write out of bounds and corrupt heap memory. The resulting corruption can destabilize the process.

How should affected systems be remediated?

Upgrade the 1.4.x branch to version 1.4.5 or later, or upgrade the 1.5.x branch to version 1.5.1 or later. These are the versions identified as containing the patch.

CVE-2026-49990: BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can exploitation cause?

How should affected systems be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can exploitation cause?

How should affected systems be remediated?