{"id":"CVE-2026-49990","kind":"vulnerability","aliases":["CVE-2026-49990"],"related":[],"title":"BACnet Stack: unchecked file offset lets remote requests crash or corrupt memory","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.","summary":"BACnet Stack is a C library implementing the BACnet building-automation protocol for embedded devices. A signed file start position in AtomicReadFile and AtomicWriteFile requests is not validated tightly enough, so a crafted request can crash the process, read adjacent memory, or write out of bounds into heap memory.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["no-file-stream-access","outside-affected-version-range"],"how_to_check":"- Check the BACnet Stack version in your build or dependency manifest; affected versions are 1.4.2 up to but not including `1.4.5`, and 1.5.0 up to but not including `1.5.1`.\n- Check whether the device exposes BACnet stream file access (AtomicReadFile or AtomicWriteFile) on a reachable network.","fix":"- Move to `1.4.5` on the 1.4 line.\n- Move to `1.5.1` on the 1.5 line.","status":"open","published_at":"2026-11-13T16:19:01+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:23+00:00","updated_at":"2026-11-13T16:48:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T16:48:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.4.5` on the 1.4 line.\n- Move to `1.5.1` on the 1.5 line.","reach":"network","title":"BACnet Stack: unchecked file offset lets remote requests crash or corrupt memory","impact":"high","summary":"BACnet Stack is a C library implementing the BACnet building-automation protocol for embedded devices. A signed file start position in AtomicReadFile and AtomicWriteFile requests is not validated tightly enough, so a crafted request can crash the process, read adjacent memory, or write out of bounds into heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation","c"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"remote crash, memory disclosure, or heap corruption in the device process","analyst_note":"","how_to_check":"- Check the BACnet Stack version in your build or dependency manifest; affected versions are 1.4.2 up to but not including `1.4.5`, and 1.5.0 up to but not including `1.5.1`.\n- Check whether the device exposes BACnet stream file access (AtomicReadFile or AtomicWriteFile) on a reachable network.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["outside-affected-version-range","no-file-stream-access"],"who_is_affected":"Teams that build firmware or gateways on the BACnet Stack C library and use its RAM file backends for AtomicReadFile or AtomicWriteFile. Devices that run only older or newer releases, or that do not serve file stream access, are outside the stated range; the sources do not say whether the RAM file backend is enabled by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4675,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-49990':15A,18A '1.4.2':92C '1.4.5':95C,168C '1.5.0':97C '1.5.1':100C,170C 'access':111C 'adjac':66B,143C 'atomicreadfil':48B,106C 'atomicwritefil':50B,108C 'autom':22B,37B 'backend':124C 'bacnet':1A,19B,26B,34B,76C,80C 'bound':72B,138C,150C 'build':21B,36B 'building-autom':20B,35B 'c':23B,30B,85C 'content':145C 'corrupt':11A,154C 'craft':59B 'crash':9A,62B,134C 'cve':13A,16A 'denial':129C 'destabil':158C 'devic':41B 'embed':24B,40B,88C 'enough':56B,117C 'expos':142C 'file':4A,44B,123C 'filestartposit':103C 'heap':74B,155C 'impact':126C 'implement':32B 'includ':127C 'issu':162C 'let':6A 'librari':31B,86C 'may':141C,153C 'memori':12A,67B,75B,144C,156C 'offset':5A 'open':81C 'out-of-bound':135C,147C 'packag':25B 'patch':165C 'posit':46B 'practic':125C 'process':64B,133C,160C 'protocol':38B,83C 'ram':122C 'reach':120C 'read':65B,139C 'reliabl':128C 'remot':7A 'request':8A,51B,60B,112C 'servic':131C 'sign':43B,102C 'sourc':82C 'stack':2A,27B,77C,84C 'start':45B 'stream':110C 'stream-access':109C 'system':89C 'taken':104C 'tight':55B,116C 'uncheck':3A 'valid':54B,115C 'version':91C,167C 'via':132C 'write':69B,151C","nicknames":[],"mitigations":[],"who_affected":"Teams that build firmware or gateways on the BACnet Stack C library and use its RAM file backends for AtomicReadFile or AtomicWriteFile. Devices that run only older or newer releases, or that do not serve file stream access, are outside the stated range; the sources do not say whether the RAM file backend is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","high","package"],"campaign_type":null,"search_a":"'-2026':14A,17A '-49990':15A,18A 'bacnet':1A 'corrupt':11A 'crash':9A 'cve':13A,16A 'file':4A 'let':6A 'memori':12A 'offset':5A 'remot':7A 'request':8A 'stack':2A 'uncheck':3A","search_b":"'adjac':66B 'atomicreadfil':48B 'atomicwritefil':50B 'autom':22B,37B 'bacnet':19B,26B,34B 'bound':72B 'build':21B,36B 'building-autom':20B,35B 'c':23B,30B 'craft':59B 'crash':62B 'devic':41B 'embed':24B,40B 'enough':56B 'file':44B 'heap':74B 'implement':32B 'librari':31B 'memori':67B,75B 'packag':25B 'posit':46B 'process':64B 'protocol':38B 'read':65B 'request':51B,60B 'sign':43B 'stack':27B 'start':45B 'tight':55B 'valid':54B 'write':69B","search_c":"'1.4.2':92C '1.4.5':95C,168C '1.5.0':97C '1.5.1':100C,170C 'access':111C 'adjac':143C 'atomicreadfil':106C 'atomicwritefil':108C 'backend':124C 'bacnet':76C,80C 'bound':138C,150C 'c':85C 'content':145C 'corrupt':154C 'crash':134C 'denial':129C 'destabil':158C 'embed':88C 'enough':117C 'expos':142C 'file':123C 'filestartposit':103C 'heap':155C 'impact':126C 'includ':127C 'issu':162C 'librari':86C 'may':141C,153C 'memori':144C,156C 'open':81C 'out-of-bound':135C,147C 'patch':165C 'practic':125C 'process':133C,160C 'protocol':83C 'ram':122C 'reach':120C 'read':139C 'reliabl':128C 'request':112C 'servic':131C 'sign':102C 'sourc':82C 'stack':77C,84C 'stream':110C 'stream-access':109C 'system':89C 'taken':104C 'tight':116C 'valid':115C 'version':91C,167C 'via':132C 'write':151C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:03:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49990","severity":null,"published_at":"2026-11-13T16:19:01+00:00","modified_at":"2026-11-13T16:19:01+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147666,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:03:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}