{"id":"CVE-2026-45265","kind":"vulnerability","aliases":["CVE-2026-45265"],"related":[],"title":"BACnet Stack: crafted file-read request overflows server stack buffer","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1.","summary":"BACnet Stack is a C library implementing the BACnet building-automation protocol for embedded devices. A crafted Atomic-Read-File request with a large RecordCount makes the server write past a stack buffer, which can let an attacker crash the server or run code on it.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["client-only","no-record-access-mode"],"how_to_check":"- Check the bacnet-stack version in your build or vendored source; affected versions are those before `1.4.4` and `1.5.1`.\n- Look for the Atomic-Read-File record access handling in your server code, which is the path that triggers the bug.","fix":"- Move to `1.4.4` or `1.5.1` or later, per the patched versions in the advisory.","status":"open","published_at":"2026-11-12T20:18:38+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:05+00:00","updated_at":"2026-11-12T20:42:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T20:42:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.4.4` or `1.5.1` or later, per the patched versions in the advisory.","reach":"network","title":"BACnet Stack: crafted file-read request overflows server stack buffer","impact":"high","summary":"BACnet Stack is a C library implementing the BACnet building-automation protocol for embedded devices. A crafted Atomic-Read-File request with a large RecordCount makes the server write past a stack buffer, which can let an attacker crash the server or run code on it.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker overwrites stack memory on the server, possibly running code","analyst_note":"Confirm whether record access mode is enabled by default and check the vendor advisory linked from the GitHub advisory for auth requirements.","how_to_check":"- Check the bacnet-stack version in your build or vendored source; affected versions are those before `1.4.4` and `1.5.1`.\n- Look for the Atomic-Read-File record access handling in your server code, which is the path that triggers the bug.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["client-only","no-record-access-mode"],"who_is_affected":"Only applications that build bacnet-stack into a BACnet server and receive requests from the network are exposed; the flaw is on the real server side when it processes Atomic-Read-File in record access mode. Client-only tools and builds that do not run this server path are less exposed. The sources do not say which default configurations enable record access mode.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4757,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-45265':14A,17A '1':183C,189C '1.4.4':88C,219C '1.5.1':90C,221C 'access':123C 'alloc':159C 'alreadi':192C 'atom':44B,117C,161C 'atomic-read-fil':43B,116C 'attack':64B 'autom':21B,36B 'bacnet':1A,18B,25B,33B,71C,75C,108C,160C 'bacnet-stack':107C 'base':96C 'bound':100C,150C,195C 'buffer':11A,59B,104C,210C 'bug':126C 'build':20B,35B 'building-autom':19B,34B 'c':22B,29B,80C 'caus':206C 'code':70B,185C 'comput':186C 'craft':3A,42B,135C 'crash':65B 'cve':12A,15A 'data':154C,164C,165C,187C 'devic':40B 'element':177C 'embed':23B,39B,83C 'excess':140C 'file':5A,46B,119C,163C 'file-read':4A 'filedata':176C,188C 'howev':167C 'implement':31B 'invalid':199C 'issu':213C 'larg':50B,141C 'later':145C 'let':62B 'librari':30B,81C 'loop':149C,180C 'make':52B 'malici':115C 'memmov':205C 'mode':124C 'object':170C 'one':175C 'open':76C 'out-of-bound':97C 'overflow':8A,105C,211C 'packag':24B 'pass':202C 'past':56B 'patch':216C 'pointer':200C 'prior':85C 'process':113C 'protocol':37B,78C 'reach':181C 'read':6A,45B,118C,162C 'real':131C 'record':122C,153C 'recordcount':51B,142C 'request':7A,47B,120C,136C 'result':198C 'run':69B 'server':9A,54B,67B,112C,132C 'set':138C 'side':133C 'sourc':77C 'space':173C 'stack':2A,10A,26B,58B,72C,79C,95C,103C,109C,158C,169C,209C 'stack-alloc':157C 'stack-bas':94C 'stack-buffer-overflow':102C,208C 'structur':166C 'system':84C 'trigger':128C 'use':146C 'version':87C,218C 'write':55B,101C,152C","nicknames":[],"mitigations":[],"who_affected":"Only applications that build bacnet-stack into a BACnet server and receive requests from the network are exposed; the flaw is on the real server side when it processes Atomic-Read-File in record access mode. Client-only tools and builds that do not run this server path are less exposed. The sources do not say which default configurations enable record access mode.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-45265':14A,17A 'bacnet':1A 'buffer':11A 'craft':3A 'cve':12A,15A 'file':5A 'file-read':4A 'overflow':8A 'read':6A 'request':7A 'server':9A 'stack':2A,10A","search_b":"'atom':44B 'atomic-read-fil':43B 'attack':64B 'autom':21B,36B 'bacnet':18B,25B,33B 'buffer':59B 'build':20B,35B 'building-autom':19B,34B 'c':22B,29B 'code':70B 'craft':42B 'crash':65B 'devic':40B 'embed':23B,39B 'file':46B 'implement':31B 'larg':50B 'let':62B 'librari':30B 'make':52B 'packag':24B 'past':56B 'protocol':37B 'read':45B 'recordcount':51B 'request':47B 'run':69B 'server':54B,67B 'stack':26B,58B 'write':55B","search_c":"'1':183C,189C '1.4.4':88C,219C '1.5.1':90C,221C 'access':123C 'alloc':159C 'alreadi':192C 'atom':117C,161C 'atomic-read-fil':116C 'bacnet':71C,75C,108C,160C 'bacnet-stack':107C 'base':96C 'bound':100C,150C,195C 'buffer':104C,210C 'bug':126C 'c':80C 'caus':206C 'code':185C 'comput':186C 'craft':135C 'data':154C,164C,165C,187C 'element':177C 'embed':83C 'excess':140C 'file':119C,163C 'filedata':176C,188C 'howev':167C 'invalid':199C 'issu':213C 'larg':141C 'later':145C 'librari':81C 'loop':149C,180C 'malici':115C 'memmov':205C 'mode':124C 'object':170C 'one':175C 'open':76C 'out-of-bound':97C 'overflow':105C,211C 'pass':202C 'patch':216C 'pointer':200C 'prior':85C 'process':113C 'protocol':78C 'reach':181C 'read':118C,162C 'real':131C 'record':122C,153C 'recordcount':142C 'request':120C,136C 'result':198C 'server':112C,132C 'set':138C 'side':133C 'sourc':77C 'space':173C 'stack':72C,79C,95C,103C,109C,158C,169C,209C 'stack-alloc':157C 'stack-bas':94C 'stack-buffer-overflow':102C,208C 'structur':166C 'system':84C 'trigger':128C 'use':146C 'version':87C,218C 'write':101C,152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:02:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-45265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45265","severity":null,"published_at":"2026-11-12T20:18:38+00:00","modified_at":"2026-11-12T20:18:38+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138274,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-v3gx-mwrp-xvh5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:02:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}