CVE-2026-46677 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for BACnet building-automation devices. A malicious BACnet device can send an AtomicReadFile reply with a record count larger than the local buffer, so the client reads memory past the end of its array.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed the BACnet Stack C library as a BACnet client and issue AtomicReadFile requests to remote devices are exposed, because the flaw is in the reply decoding. Servers or devices that only answer requests, and projects that do not use the client file-read path, are less exposed. The sources do not say whether network-only traffic is enough to trigger it.
Not affected if no-atomic-read-file-client
Who cares bacnet, building-automation, c, embedded
grep -ri bacnet in your dependency manifest or the vendored source.1.4.4 on the 1.4 line1.5.1 on the 1.5 lineBACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.