{"id":"CVE-2026-46677","kind":"vulnerability","aliases":["CVE-2026-46677"],"related":[],"title":"BACnet Stack: out-of-bounds read when a client decodes file records","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1.","summary":"BACnet Stack is a C library for BACnet building-automation devices. A malicious BACnet device can send an AtomicReadFile reply with a record count larger than the local buffer, so the client reads memory past the end of its array.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["no-atomic-read-file-client"],"how_to_check":"- Check the BACnet Stack version in your project, for example with `grep -ri bacnet` in your dependency manifest or the vendored source.\n- Confirm whether your client code calls the AtomicReadFile request path.","fix":"- BACnet Stack `1.4.4` on the 1.4 line\n- BACnet Stack `1.5.1` on the 1.5 line","status":"open","published_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:20+00:00","updated_at":"2026-11-12T20:42:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T20:42:20Z","model":"claude-haiku-5-5","output":{"fix":"- BACnet Stack `1.4.4` on the 1.4 line\n- BACnet Stack `1.5.1` on the 1.5 line","reach":"network","title":"BACnet Stack: out-of-bounds read when a client decodes file records","impact":"low","summary":"BACnet Stack is a C library for BACnet building-automation devices. A malicious BACnet device can send an AtomicReadFile reply with a record count larger than the local buffer, so the client reads memory past the end of its array.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c","building-automation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Client reads memory out of bounds, possibly crashing the process","analyst_note":"","how_to_check":"- Check the BACnet Stack version in your project, for example with `grep -ri bacnet` in your dependency manifest or the vendored source.\n- Confirm whether your client code calls the AtomicReadFile request path.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-atomic-read-file-client"],"who_is_affected":"Applications that embed the BACnet Stack C library as a BACnet client and issue AtomicReadFile requests to remote devices are exposed, because the flaw is in the reply decoding. Servers or devices that only answer requests, and projects that do not use the client file-read path, are less exposed. The sources do not say whether network-only traffic is enough to trigger it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4702,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-46677':16A,19A '1.4.4':85C,175C '1.5.1':87C,177C 'access':106C 'ack':103C,135C 'array':67B,126C 'atom':130C 'atomicreadfil':46B,102C 'atomicreadfile-ack':101C 'autom':23B,37B 'bacnet':1A,20B,27B,34B,41B,68C,72C,129C 'bound':6A,97C,167C 'buffer':56B 'build':22B,36B 'building-autom':21B,35B 'c':24B,31B,77C 'capac':127C 'caus':112C 'client':10A,59B,92C 'client-sid':91C 'count':51B,150C 'cve':14A,17A 'data':133C 'decod':11A,136C 'devic':38B,42B 'discard':142C 'downstream':153C 'embed':25B,80C 'end':64B 'excess':145C 'file':12A,132C 'filedata':125C,163C 'fix':123C 'handl':107C 'index':162C 'issu':110C,169C 'iter':156C 'larger':52B 'later':155C 'librari':32B,78C 'local':55B,124C 'malici':40B 'memori':61B 'mismatch':115C 'open':73C 'origin':159C 'out-of-bound':3A,94C 'packag':26B 'past':62B 'patch':172C 'path':108C,137C 'preserv':138C 'prior':82C 'protocol':75C 'read':7A,60B,98C,131C 'record':13A,50B,105C,146C 'record-access':104C 'recordcount':141C,160C 'remot':118C,140C 'repli':47B 'returnedrecordcount':119C 'send':44B 'side':93C 'sink':154C 'sourc':74C 'stack':2A,28B,69C,76C 'storag':143C 'system':81C 'truncat':148C 'valu':120C 'version':84C,174C 'without':147C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the BACnet Stack C library as a BACnet client and issue AtomicReadFile requests to remote devices are exposed, because the flaw is in the reply decoding. Servers or devices that only answer requests, and projects that do not use the client file-read path, are less exposed. The sources do not say whether network-only traffic is enough to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","medium","package"],"campaign_type":null,"search_a":"'-2026':15A,18A '-46677':16A,19A 'bacnet':1A 'bound':6A 'client':10A 'cve':14A,17A 'decod':11A 'file':12A 'out-of-bound':3A 'read':7A 'record':13A 'stack':2A","search_b":"'array':67B 'atomicreadfil':46B 'autom':23B,37B 'bacnet':20B,27B,34B,41B 'buffer':56B 'build':22B,36B 'building-autom':21B,35B 'c':24B,31B 'client':59B 'count':51B 'devic':38B,42B 'embed':25B 'end':64B 'larger':52B 'librari':32B 'local':55B 'malici':40B 'memori':61B 'packag':26B 'past':62B 'read':60B 'record':50B 'repli':47B 'send':44B 'stack':28B","search_c":"'1.4.4':85C,175C '1.5.1':87C,177C 'access':106C 'ack':103C,135C 'array':126C 'atom':130C 'atomicreadfil':102C 'atomicreadfile-ack':101C 'bacnet':68C,72C,129C 'bound':97C,167C 'c':77C 'capac':127C 'caus':112C 'client':92C 'client-sid':91C 'count':150C 'data':133C 'decod':136C 'discard':142C 'downstream':153C 'embed':80C 'excess':145C 'file':132C 'filedata':125C,163C 'fix':123C 'handl':107C 'index':162C 'issu':110C,169C 'iter':156C 'later':155C 'librari':78C 'local':124C 'mismatch':115C 'open':73C 'origin':159C 'out-of-bound':94C 'patch':172C 'path':108C,137C 'preserv':138C 'prior':82C 'protocol':75C 'read':98C,131C 'record':105C,146C 'record-access':104C 'recordcount':141C,160C 'remot':118C,140C 'returnedrecordcount':119C 'side':93C 'sink':154C 'sourc':74C 'stack':69C,76C 'storag':143C 'system':81C 'truncat':148C 'valu':120C 'version':84C,174C 'without':147C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:02:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46677","severity":null,"published_at":"2026-11-12T20:18:39+00:00","modified_at":"2026-11-12T20:18:39+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[{"id":138278,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rv5h-cxwq-q3mh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:02:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}