CVE-2026-46674 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for BACnet building-automation devices. A mismatch between an externally supplied record count and a fixed-size internal array lets an attacker read memory outside that array.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that build BACnet devices or gateways on bacnet-stack before 1.4.4 or 1.5.1 and expose the AtomicWriteFile service to other networks. Applications that do not compile in or handle AtomicWriteFile requests are less exposed. Sources do not say which products ship it.
Not affected if no-atomicwritefile-service, patched-version
Who cares bacnet, building-automation, embedded
grep -i version on the bacnet-stack source tree1.4.4 or 1.5.1, the patched versions named in the advisoryBACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.