CVE-2026-62976: BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause recordcount() to call bacnetstrnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the RAMFS-backed FILE object implementation in BACnet Stack versions before 1.5.1 are affected. The issue concerns record-access AtomicWriteFile append operations.
What sequence is required to trigger the issue?
An attacker or client must send two consecutive AtomicWriteFile requests using record access and append behavior. That sequence can cause record_count() to read one byte past the heap allocation.
Which versions contain the fix?
The issue is patched in BACnet Stack versions 1.5.1 and 1.6.0.