CVE-2026-49990 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library implementing the BACnet building-automation protocol for embedded devices. A signed file start position in AtomicReadFile and AtomicWriteFile requests is not validated tightly enough, so a crafted request can crash the process, read adjacent memory, or write out of bounds into heap memory.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that build firmware or gateways on the BACnet Stack C library and use its RAM file backends for AtomicReadFile or AtomicWriteFile. Devices that run only older or newer releases, or that do not serve file stream access, are outside the stated range; the sources do not say whether the RAM file backend is enabled by default.
Not affected if no-file-stream-access, outside-affected-version-range
Who cares bacnet, building-automation, c, embedded
1.4.5, and 1.5.0 up to but not including 1.5.1.1.4.5 on the 1.4 line.1.5.1 on the 1.5 line.BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.