---
id: "CVE-2026-62977"
page: "https://infrastack.ai/live/CVE-2026-62977"
kind: "vulnerability"
aliases: ["CVE-2026-62977"]
title: "BACnet Stack: remote clients can read uninitialized memory from read-only files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bacnet", "building-automation", "embedded", "package"]
not_affected_if: ["file-object-disabled", "non-ramfs-backend"]
published_at: "2026-11-13T19:19:33+00:00"
first_seen_at: "2026-11-13T19:52:09+00:00"
updated_at: "2026-11-13T19:54:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62977", "first_seen_at": "2026-11-13T19:52:09+00:00"}]
exploit_sources: []
---

# BACnet Stack: remote clients can read uninitialized memory from read-only files

Link for people: https://infrastack.ai/live/CVE-2026-62977 (this .md is for agents)

BACnet Stack is a C library for building BACnet building-automation devices. A remote client can enlarge a read-only RAMFS-backed stream file and read back the newly exposed region, which may contain stale heap memory from the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BACnet Stack version in your build, for example `grep -i bacnet` on the vendored source or your package manifest.
- Look for the BACnet FILE object with RAMFS backend enabled in your device configuration.

## Fix

- BACnet Stack versions `1.5.1` and `1.6.0`, per the advisory.

## Timeline

- 2026-11-13T19:52:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62977

## Documents

- [advisory] Vendor advisory: github.com https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934

## From the sources

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_