CVE-2026-45265 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library implementing the BACnet building-automation protocol for embedded devices. A crafted Atomic-Read-File request with a large RecordCount makes the server write past a stack buffer, which can let an attacker crash the server or run code on it.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that build bacnet-stack into a BACnet server and receive requests from the network are exposed; the flaw is on the real server side when it processes Atomic-Read-File in record access mode. Client-only tools and builds that do not run this server path are less exposed. The sources do not say which default configurations enable record access mode.
Not affected if client-only, no-record-access-mode
Who cares bacnet, building-automation, c, embedded
1.4.4 and 1.5.1.1.4.4 or 1.5.1 or later, per the patched versions in the advisory.BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.