CVE-2026-62972: BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lightingcommanddecode in src/bacnet/lighting.c decodes its first field with the bounded apdusize - apdulen, but every nested decode in the operation switch is called with the original full apdusize while the read pointer has been advanced to &apdu[apdulen]. The leaf decoders bound their reads against the size they are told, so they read up to apdulen bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.