{"id":"CVE-2026-46676","kind":"vulnerability","aliases":["CVE-2026-46676"],"related":[],"title":"BACnet Stack: uninitialized value lets crafted file-read requests corrupt responses","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, an uninitialized value use vulnerability in bacnet-stack's AtomicReadFile record-access ACK encoder allows unauthenticated remote attackers to corrupt the encoded OCTET STRING length and payload boundary in network responses by sending a crafted AtomicReadFile request that reaches a successful record-access path. This issue has been patched in versions 1.4.4 and 1.5.1.","summary":"BACnet Stack is an open source BACnet protocol C library used in embedded building-automation devices. A crafted unauthenticated AtomicReadFile request can corrupt the length and payload boundary of the encoded response, because an uninitialized value is used.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bacnet-stack","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["bacnet-not-exposed","no-record-access-handling"],"how_to_check":"- Check the bacnet-stack version in your build or vendored source, for example `grep -ri \"bacnet\" package.json` or your embedded firmware's version string.\n- Look for BACnet services exposed on the network, where AtomicReadFile is handled.","fix":"- bacnet-stack `1.4.4` for the 1.4.x line\n- bacnet-stack `1.5.1` for the 1.5.x line","status":"open","published_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:24+00:00","updated_at":"2026-11-12T20:42:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T20:42:24Z","model":"claude-haiku-5-5","output":{"fix":"- bacnet-stack `1.4.4` for the 1.4.x line\n- bacnet-stack `1.5.1` for the 1.5.x line","reach":"network","title":"BACnet Stack: uninitialized value lets crafted file-read requests corrupt responses","impact":"low","summary":"BACnet Stack is an open source BACnet protocol C library used in embedded building-automation devices. A crafted unauthenticated AtomicReadFile request can corrupt the length and payload boundary of the encoded response, because an uninitialized value is used.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"corrupted responses to remote BACnet clients, possible boundary errors","analyst_note":"","how_to_check":"- Check the bacnet-stack version in your build or vendored source, for example `grep -ri \"bacnet\" package.json` or your embedded firmware's version string.\n- Look for BACnet services exposed on the network, where AtomicReadFile is handled.","plain_action":"","product_name":"bacnet-stack","needs_analyst":false,"not_affected_if":["bacnet-not-exposed","no-record-access-handling"],"who_is_affected":"Systems built on bacnet-stack versions 1.4.0 up to 1.4.4, and 1.5.0 up to 1.5.1, that answer AtomicReadFile requests from the network. Devices that do not expose BACnet to untrusted networks, or that do not handle record-access file reads, are less exposed. The sources do not say how common record-access handling is in shipped products.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4656,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-46676':15A,18A '1.4.0':84C '1.4.4':87C,147C '1.5.0':89C '1.5.1':92C,149C 'access':106C,138C 'ack':107C 'allow':109C 'atomicreadfil':49B,103C,130C 'attack':112C 'autom':25B,44B 'bacnet':1A,20A,22B,29B,35B,68C,72C,100C 'bacnet-stack':19A,99C 'boundari':57B,122C 'build':24B,43B 'building-autom':23B,42B 'c':26B,37B,77C 'corrupt':11A,52B,114C 'craft':6A,47B,129C 'cve':13A,16A 'devic':45B 'embed':27B,41B,80C 'encod':60B,108C,116C 'file':8A 'file-read':7A 'issu':141C 'length':54B,119C 'let':5A 'librari':38B,78C 'network':124C 'octet':117C 'open':33B,73C 'packag':28B 'patch':144C 'path':139C 'payload':56B,121C 'protocol':36B,75C 'reach':133C 'read':9A 'record':105C,137C 'record-access':104C,136C 'remot':111C 'request':10A,50B,131C 'respons':12A,61B,125C 'send':127C 'sourc':34B,74C 'stack':2A,21A,30B,69C,76C,101C 'string':118C 'success':135C 'system':81C 'unauthent':48B,110C 'uniniti':3A,64B,94C 'use':39B,67B,96C 'valu':4A,65B,95C 'version':83C,146C 'vulner':97C","nicknames":[],"mitigations":[],"who_affected":"Systems built on bacnet-stack versions 1.4.0 up to 1.4.4, and 1.5.0 up to 1.5.1, that answer AtomicReadFile requests from the network. Devices that do not expose BACnet to untrusted networks, or that do not handle record-access file reads, are less exposed. The sources do not say how common record-access handling is in shipped products.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["bacnetstack"],"ptokens":["bacnet","stack"],"labels":["bacnet","buildingautomation","c","embedded","medium","package","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-46676':15A,18A 'bacnet':1A,20A 'bacnet-stack':19A 'corrupt':11A 'craft':6A 'cve':13A,16A 'file':8A 'file-read':7A 'let':5A 'read':9A 'request':10A 'respons':12A 'stack':2A,21A 'uniniti':3A 'valu':4A","search_b":"'atomicreadfil':49B 'autom':25B,44B 'bacnet':22B,29B,35B 'boundari':57B 'build':24B,43B 'building-autom':23B,42B 'c':26B,37B 'corrupt':52B 'craft':47B 'devic':45B 'embed':27B,41B 'encod':60B 'length':54B 'librari':38B 'open':33B 'packag':28B 'payload':56B 'protocol':36B 'request':50B 'respons':61B 'sourc':34B 'stack':30B 'unauthent':48B 'uniniti':64B 'use':39B,67B 'valu':65B","search_c":"'1.4.0':84C '1.4.4':87C,147C '1.5.0':89C '1.5.1':92C,149C 'access':106C,138C 'ack':107C 'allow':109C 'atomicreadfil':103C,130C 'attack':112C 'bacnet':68C,72C,100C 'bacnet-stack':99C 'boundari':122C 'c':77C 'corrupt':114C 'craft':129C 'embed':80C 'encod':108C,116C 'issu':141C 'length':119C 'librari':78C 'network':124C 'octet':117C 'open':73C 'patch':144C 'path':139C 'payload':121C 'protocol':75C 'reach':133C 'record':105C,137C 'record-access':104C,136C 'remot':111C 'request':131C 'respons':125C 'send':127C 'sourc':74C 'stack':69C,76C,101C 'string':118C 'success':135C 'system':81C 'unauthent':110C 'uniniti':94C 'use':96C 'valu':95C 'version':83C,146C 'vulner':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:02:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46676","severity":null,"published_at":"2026-11-12T20:18:39+00:00","modified_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138277,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2fwp-32cj-g3x4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:02:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}