{"id":"CVE-2026-46674","kind":"vulnerability","aliases":["CVE-2026-46674"],"related":[],"title":"BACnet Stack: out-of-bounds read in AtomicWriteFile record handling","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1.","summary":"BACnet Stack is a C library for BACnet building-automation devices. A mismatch between an externally supplied record count and a fixed-size internal array lets an attacker read memory outside that array.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","embedded","package"],"not_affected_if":["no-atomicwritefile-service","patched-version"],"how_to_check":"- Check the bacnet-stack version in your build or vendored source, for example with `grep -i version` on the bacnet-stack source tree\n- Confirm whether your device or application uses the AtomicWriteFile service (BACNET_ATOMIC_WRITE_FILE_DATA)","fix":"- bacnet-stack: move to `1.4.4` or `1.5.1`, the patched versions named in the advisory","status":"open","published_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:10+00:00","updated_at":"2026-11-12T20:42:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T20:42:10Z","model":"claude-haiku-5-5","output":{"fix":"- bacnet-stack: move to `1.4.4` or `1.5.1`, the patched versions named in the advisory","reach":"network","title":"BACnet Stack: out-of-bounds read in AtomicWriteFile record handling","impact":"medium","summary":"BACnet Stack is a C library for BACnet building-automation devices. A mismatch between an externally supplied record count and a fixed-size internal array lets an attacker read memory outside that array.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads memory beyond the fixed file data buffer","analyst_note":"","how_to_check":"- Check the bacnet-stack version in your build or vendored source, for example with `grep -i version` on the bacnet-stack source tree\n- Confirm whether your device or application uses the AtomicWriteFile service (BACNET_ATOMIC_WRITE_FILE_DATA)","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-atomicwritefile-service","patched-version"],"who_is_affected":"Teams that build BACnet devices or gateways on bacnet-stack before 1.4.4 or 1.5.1 and expose the AtomicWriteFile service to other networks. Applications that do not compile in or handle AtomicWriteFile requests are less exposed. Sources do not say which products ship it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4642,"output_tokens":552,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-46674':14A,17A '1.4.4':76C,132C '1.5.1':78C,134C 'access':95C 'array':50B,58B,117C 'atom':121C 'atomicwritefil':9A,92C 'attack':53B 'autom':21B,34B 'bacnet':1A,18B,24B,31B,59C,63C,89C,120C 'bacnet-stack':88C 'bound':6A,83C 'bug':98C 'build':20B,33B 'building-autom':19B,32B 'c':28B,68C 'caus':100C 'control':107C 'count':43B 'cve':12A,15A 'data':124C 'devic':35B 'embed':22B,71C 'exist':86C 'extern':40B,106C 'field':109C 'file':123C 'filedata':116C 'fix':47B,113C 'fixed-s':46B,112C 'handl':11A 'intern':49B,115C 'issu':126C 'let':51B 'librari':29B,69C 'memori':55B 'mismatch':37B,103C 'open':64C 'out-of-bound':3A,80C 'outsid':56B 'packag':23B 'patch':129C 'path':96C 'prior':73C 'protocol':66C 'read':7A,54B,84C 'record':10A,42B,94C 'record-access':93C 'returnedrecordcount':108C 'size':48B,114C 'sourc':65C 'stack':2A,25B,60C,67C,90C 'suppli':41B 'system':72C 'use':118C 'version':75C,131C 'vulner':85C 'write':122C","nicknames":[],"mitigations":[],"who_affected":"Teams that build BACnet devices or gateways on bacnet-stack before 1.4.4 or 1.5.1 and expose the AtomicWriteFile service to other networks. Applications that do not compile in or handle AtomicWriteFile requests are less exposed. Sources do not say which products ship it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-46674':14A,17A 'atomicwritefil':9A 'bacnet':1A 'bound':6A 'cve':12A,15A 'handl':11A 'out-of-bound':3A 'read':7A 'record':10A 'stack':2A","search_b":"'array':50B,58B 'attack':53B 'autom':21B,34B 'bacnet':18B,24B,31B 'build':20B,33B 'building-autom':19B,32B 'c':28B 'count':43B 'devic':35B 'embed':22B 'extern':40B 'fix':47B 'fixed-s':46B 'intern':49B 'let':51B 'librari':29B 'memori':55B 'mismatch':37B 'outsid':56B 'packag':23B 'read':54B 'record':42B 'size':48B 'stack':25B 'suppli':41B","search_c":"'1.4.4':76C,132C '1.5.1':78C,134C 'access':95C 'array':117C 'atom':121C 'atomicwritefil':92C 'bacnet':59C,63C,89C,120C 'bacnet-stack':88C 'bound':83C 'bug':98C 'c':68C 'caus':100C 'control':107C 'data':124C 'embed':71C 'exist':86C 'extern':106C 'field':109C 'file':123C 'filedata':116C 'fix':113C 'fixed-s':112C 'intern':115C 'issu':126C 'librari':69C 'mismatch':103C 'open':64C 'out-of-bound':80C 'patch':129C 'path':96C 'prior':73C 'protocol':66C 'read':84C 'record':94C 'record-access':93C 'returnedrecordcount':108C 'size':114C 'sourc':65C 'stack':60C,67C,90C 'system':72C 'use':118C 'version':75C,131C 'vulner':85C 'write':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:02:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46674","severity":null,"published_at":"2026-11-12T20:18:39+00:00","modified_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138276,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8384-pwhh-cxjh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:02:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}