{"id":"CVE-2026-62977","kind":"vulnerability","aliases":["CVE-2026-62977"],"related":[],"title":"BACnet Stack: remote clients can read uninitialized memory from read-only files","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A remote client can enlarge a read-only RAMFS-backed stream file and read back the newly exposed region, which may contain stale heap memory from the process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bacnet","building-automation","embedded","package"],"not_affected_if":["file-object-disabled","non-ramfs-backend"],"how_to_check":"- Check the BACnet Stack version in your build, for example `grep -i bacnet` on the vendored source or your package manifest.\n- Look for the BACnet FILE object with RAMFS backend enabled in your device configuration.","fix":"- BACnet Stack versions `1.5.1` and `1.6.0`, per the advisory.","status":"open","published_at":"2026-11-13T19:19:33+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","triaged_at":"2026-11-13T19:54:12+00:00","updated_at":"2026-11-13T19:54:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T19:54:12Z","model":"claude-haiku-5-5","output":{"fix":"- BACnet Stack versions `1.5.1` and `1.6.0`, per the advisory.","reach":"network","title":"BACnet Stack: remote clients can read uninitialized memory from read-only files","impact":"medium","summary":"BACnet Stack is a C library for building BACnet building-automation devices. A remote client can enlarge a read-only RAMFS-backed stream file and read back the newly exposed region, which may contain stale heap memory from the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","embedded","building-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"remote client reads leftover process memory from a device","analyst_note":"","how_to_check":"- Check the BACnet Stack version in your build, for example `grep -i bacnet` on the vendored source or your package manifest.\n- Look for the BACnet FILE object with RAMFS backend enabled in your device configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["file-object-disabled","non-ramfs-backend"],"who_is_affected":"Only devices or applications built on BACnet Stack before 1.5.1 that expose a BACnet FILE object with the RAMFS backend to the network. Applications that do not use the FILE object or do not use RAMFS can likely skip it, though the sources do not state this explicitly.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4790,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-62977':16A,19A '1.5.1':86C,229C '1.6.0':231C 'access':107C,164C,178C 'alloc':182C 'allow':92C 'also':210C 'atomicreadfil':175C 'autom':23B,37B 'back':50B,55B,161C 'backend':122C 'bacnet':1A,20B,26B,34B,69C,73C,88C 'build':22B,33B,36B,184C 'building-autom':21B,35B 'byte':193C 'c':30B,78C 'chang':100C 'check':111C 'client':4A,41B,152C 'configur':185C 'contain':62B,190C 'content':196C,213C 'cve':14A,17A 'data':188C 'depend':179C 'devic':38B 'embed':24B,81C 'enlarg':43B,125C,154C 'expos':58B,138C,172C 'file':13A,52B,89C,96C,108C,114C,121C,127C,165C,204C 'fill':192C 'heap':64B,195C 'immedi':168C 'implement':91C 'initi':143C 'intend':216C 'issu':223C 'later':145C 'librari':31B,79C 'mark':116C 'may':61B,189C 'memori':8A,65B,201C 'newli':57B,137C,171C 'object':90C,109C 'open':74C 'packag':25B 'patch':226C 'path':208C 'perform':129C 'prior':83C 'process':68B,200C 'prop':95C 'protocol':76C 'ramf':49B,124C,160C 'ramfs-back':48B,159C 'read':6A,11A,46B,54B,117C,146C,157C,220C 'read-on':10A,45B,156C,219C 'realloc':130C 'region':59B,140C,173C 'remot':3A,40B,93C,151C,211C 'request':98C 'result':149C 'retriev':169C 'return':187C 'sanit':191C 'shrink':202C 'size':97C,102C,135C 'sourc':75C 'stack':2A,27B,70C,77C 'stale':63B,194C 'store':134C 'stream':51B,106C,163C,177C 'stream-access':105C,162C,176C 'system':82C 'tail':139C 'truncat':212C 'uniniti':7A 'unintend':199C 'updat':132C 'version':85C,228C 'whether':112C 'without':110C 'writeproperti':94C","nicknames":[],"mitigations":[],"who_affected":"Only devices or applications built on BACnet Stack before 1.5.1 that expose a BACnet FILE object with the RAMFS backend to the network. Applications that do not use the FILE object or do not use RAMFS can likely skip it, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bacnet","buildingautomation","embedded","medium","package"],"campaign_type":null,"search_a":"'-2026':15A,18A '-62977':16A,19A 'bacnet':1A 'client':4A 'cve':14A,17A 'file':13A 'memori':8A 'read':6A,11A 'read-on':10A 'remot':3A 'stack':2A 'uniniti':7A","search_b":"'autom':23B,37B 'back':50B,55B 'bacnet':20B,26B,34B 'build':22B,33B,36B 'building-autom':21B,35B 'c':30B 'client':41B 'contain':62B 'devic':38B 'embed':24B 'enlarg':43B 'expos':58B 'file':52B 'heap':64B 'librari':31B 'may':61B 'memori':65B 'newli':57B 'packag':25B 'process':68B 'ramf':49B 'ramfs-back':48B 'read':46B,54B 'read-on':45B 'region':59B 'remot':40B 'stack':27B 'stale':63B 'stream':51B","search_c":"'1.5.1':86C,229C '1.6.0':231C 'access':107C,164C,178C 'alloc':182C 'allow':92C 'also':210C 'atomicreadfil':175C 'back':161C 'backend':122C 'bacnet':69C,73C,88C 'build':184C 'byte':193C 'c':78C 'chang':100C 'check':111C 'client':152C 'configur':185C 'contain':190C 'content':196C,213C 'data':188C 'depend':179C 'embed':81C 'enlarg':125C,154C 'expos':138C,172C 'file':89C,96C,108C,114C,121C,127C,165C,204C 'fill':192C 'heap':195C 'immedi':168C 'implement':91C 'initi':143C 'intend':216C 'issu':223C 'later':145C 'librari':79C 'mark':116C 'may':189C 'memori':201C 'newli':137C,171C 'object':90C,109C 'open':74C 'patch':226C 'path':208C 'perform':129C 'prior':83C 'process':200C 'prop':95C 'protocol':76C 'ramf':124C,160C 'ramfs-back':159C 'read':117C,146C,157C,220C 'read-on':156C,219C 'realloc':130C 'region':140C,173C 'remot':93C,151C,211C 'request':98C 'result':149C 'retriev':169C 'return':187C 'sanit':191C 'shrink':202C 'size':97C,102C,135C 'sourc':75C 'stack':70C,77C 'stale':194C 'store':134C 'stream':106C,163C,177C 'stream-access':105C,162C,176C 'system':82C 'tail':139C 'truncat':212C 'unintend':199C 'updat':132C 'version':85C,228C 'whether':112C 'without':110C 'writeproperti':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-16T13:19:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62977","severity":null,"published_at":"2026-11-13T19:19:33+00:00","modified_at":"2026-11-13T19:19:33+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:09+00:00","note":null}],"documents":[{"id":149166,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-16T13:19:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}