{"id":"CVE-2026-62972","kind":"vulnerability","aliases":["CVE-2026-62972"],"related":[],"title":"BACnet Stack: lighting command decoder reads past end of buffer","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A nested decode in its lighting command parser is given the wrong buffer size, so it reads past the end of the received packet, an out-of-bounds read.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","c","embedded","package"],"not_affected_if":["lighting-service-unused","not-using-bacnet-stack"],"how_to_check":"- Check the BACnet Stack version in your build, for example in the source tree or the vendored copy; affected versions are before `1.4.5`, `1.5.1` and `1.6.0`.\n- Look for `lighting_command_decode` in `src/bacnet/lighting.c` to confirm the vulnerable code is present.","fix":"- Upgrade to `1.4.5`, `1.5.1` or `1.6.0` depending on the release line in use.","status":"open","published_at":"2026-11-13T16:19:28+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:45+00:00","updated_at":"2026-11-13T16:48:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T16:48:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `1.4.5`, `1.5.1` or `1.6.0` depending on the release line in use.","reach":"network","title":"BACnet Stack: lighting command decoder reads past end of buffer","impact":"low","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A nested decode in its lighting command parser is given the wrong buffer size, so it reads past the end of the received packet, an out-of-bounds read.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","c","building-automation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"out-of-bounds memory read from network-received packet data","analyst_note":"Sources do not say whether the lighting service is enabled by default or how easily it is reached over the network.\n","how_to_check":"- Check the BACnet Stack version in your build, for example in the source tree or the vendored copy; affected versions are before `1.4.5`, `1.5.1` and `1.6.0`.\n- Look for `lighting_command_decode` in `src/bacnet/lighting.c` to confirm the vulnerable code is present.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-using-bacnet-stack","lighting-service-unused"],"who_is_affected":"Teams that build or run BACnet devices, gateways or tools on the BACnet Stack C library, especially embedded firmware that accepts BACnet lighting-control messages from the network. Systems that do not use this library or the lighting command service can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4697,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62972':13A,16A '1.4.5':84C,174C '1.5.1':85C,175C '1.6.0':87C,177C 'advanc':126C 'apdu':100C,102C,118C,128C,129C,148C 'autom':20B,35B 'bacnet':1A,17B,24B,32B,67C,71C 'bound':65B,99C,134C,165C 'buffer':10A,49B,158C 'build':19B,31B,34B 'building-autom':18B,33B 'byte':150C 'c':21B,28B,76C 'call':113C 'caller':156C 'command':4A,43B,89C 'cve':11A,14A 'decod':5A,39B,90C,93C,107C,133C 'devic':36B 'embed':22B,79C 'end':8A,56B,153C 'everi':105C 'field':96C 'first':95C 'full':117C 'given':46B 'issu':168C 'leaf':132C 'len':103C,130C,149C 'librari':29B,77C 'light':3A,42B,88C 'nest':38B,106C 'open':72C 'oper':110C 'origin':116C 'out-of-bound':62B,162C 'packag':23B 'packet':60B 'parser':44B 'past':7A,54B,151C 'patch':171C 'pointer':123C 'prior':81C 'protocol':74C 'read':6A,53B,66B,122C,136C,145C,166C 'receiv':59B 'result':159C 'size':50B,101C,119C,139C 'sourc':73C 'src/bacnet/lighting.c':92C 'stack':2A,25B,68C,75C 'switch':111C 'system':80C 'told':142C 'version':83C,173C 'wrong':48B","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run BACnet devices, gateways or tools on the BACnet Stack C library, especially embedded firmware that accepts BACnet lighting-control messages from the network. Systems that do not use this library or the lighting command service can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","c","embedded","medium","package"],"campaign_type":null,"search_a":"'-2026':12A,15A '-62972':13A,16A 'bacnet':1A 'buffer':10A 'command':4A 'cve':11A,14A 'decod':5A 'end':8A 'light':3A 'past':7A 'read':6A 'stack':2A","search_b":"'autom':20B,35B 'bacnet':17B,24B,32B 'bound':65B 'buffer':49B 'build':19B,31B,34B 'building-autom':18B,33B 'c':21B,28B 'command':43B 'decod':39B 'devic':36B 'embed':22B 'end':56B 'given':46B 'librari':29B 'light':42B 'nest':38B 'out-of-bound':62B 'packag':23B 'packet':60B 'parser':44B 'past':54B 'read':53B,66B 'receiv':59B 'size':50B 'stack':25B 'wrong':48B","search_c":"'1.4.5':84C,174C '1.5.1':85C,175C '1.6.0':87C,177C 'advanc':126C 'apdu':100C,102C,118C,128C,129C,148C 'bacnet':67C,71C 'bound':99C,134C,165C 'buffer':158C 'byte':150C 'c':76C 'call':113C 'caller':156C 'command':89C 'decod':90C,93C,107C,133C 'embed':79C 'end':153C 'everi':105C 'field':96C 'first':95C 'full':117C 'issu':168C 'leaf':132C 'len':103C,130C,149C 'librari':77C 'light':88C 'nest':106C 'open':72C 'oper':110C 'origin':116C 'out-of-bound':162C 'past':151C 'patch':171C 'pointer':123C 'prior':81C 'protocol':74C 'read':122C,136C,145C,166C 'result':159C 'size':101C,119C,139C 'sourc':73C 'src/bacnet/lighting.c':92C 'stack':68C,75C 'switch':111C 'system':80C 'told':142C 'version':83C,173C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-16T13:19:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62972","severity":null,"published_at":"2026-11-13T16:19:28+00:00","modified_at":"2026-11-13T16:19:28+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null}],"documents":[{"id":147673,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-16T13:19:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}