Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
82 vulnerabilities by bacnet-stack
CVE-2026-97692 (GCVE-0-2026-97692)
Vulnerability from nvd – Published: 2026-11-13 18:42 – Updated: 2026-11-13 18:42
VLAI
EPSS
VEX
Title
BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
7.7 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1435 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option\u0027s MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer\u0027s prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:42:41.703Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-gr74-333w-7wg8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-gr74-333w-7wg8"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1435",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1435"
}
],
"source": {
"advisory": "GHSA-gr74-333w-7wg8",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-97692",
"datePublished": "2026-11-13T18:42:41.703Z",
"dateReserved": "2026-09-24T21:43:37.208Z",
"dateUpdated": "2026-11-13T18:42:41.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82414 (GCVE-0-2026-82414)
Vulnerability from nvd – Published: 2026-11-13 18:40 – Updated: 2026-11-13 21:18
VLAI
EPSS
VEX
Title
BACnet Stack: MS/TP COBS decode overflow
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:17 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1425 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
>= 1.4.0, < 1.4.6
Affected: >= 1.5.0, < 1.5.1 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82414",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:17:48.680575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:18:08.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.4.0, \u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:40:31.749Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1425",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1425"
}
],
"source": {
"advisory": "GHSA-8456-m9x4-j6mc",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: MS/TP COBS decode overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-82414",
"datePublished": "2026-11-13T18:40:31.749Z",
"dateReserved": "2026-08-28T22:00:43.514Z",
"dateUpdated": "2026-11-13T21:18:08.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64675 (GCVE-0-2026-64675)
Vulnerability from nvd – Published: 2026-11-13 18:51 – Updated: 2026-11-13 21:19
VLAI
EPSS
VEX
Title
BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:19 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1386 | x_refsource_MISC |
| https://github.com/bacnet-stack/bacnet-stack/pull/1387 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64675",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:19:09.622280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:19:27.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:51:06.844Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1386",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1386"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1387",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1387"
}
],
"source": {
"advisory": "GHSA-mmg6-p4pr-cj6h",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-64675",
"datePublished": "2026-11-13T18:51:06.844Z",
"dateReserved": "2026-07-20T17:12:12.891Z",
"dateUpdated": "2026-11-13T21:19:27.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62977 (GCVE-0-2026-62977)
Vulnerability from nvd – Published: 2026-11-13 18:40 – Updated: 2026-11-13 18:40
VLAI
EPSS
VEX
Title
BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1411 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.5.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908: Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:40:09.732Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1411",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1411"
}
],
"source": {
"advisory": "GHSA-mwj7-2v5r-v934",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62977",
"datePublished": "2026-11-13T18:40:09.732Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T18:40:09.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62976 (GCVE-0-2026-62976)
Vulnerability from nvd – Published: 2026-11-13 18:39 – Updated: 2026-11-13 18:39
VLAI
EPSS
VEX
Title
BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1408 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.5.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:39:25.636Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-32jj-x86x-w98w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-32jj-x86x-w98w"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1408"
}
],
"source": {
"advisory": "GHSA-32jj-x86x-w98w",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62976",
"datePublished": "2026-11-13T18:39:25.636Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T18:39:25.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62975 (GCVE-0-2026-62975)
Vulnerability from nvd – Published: 2026-11-13 18:38 – Updated: 2026-11-13 18:38
VLAI
EPSS
VEX
Title
BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1408 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.5.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:38:57.163Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1408"
}
],
"source": {
"advisory": "GHSA-cf8g-hp9m-9fvv",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62975",
"datePublished": "2026-11-13T18:38:57.163Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T18:38:57.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104204 (GCVE-0-2026-104204)
Vulnerability from nvd – Published: 2026-11-13 18:44 – Updated: 2026-11-13 21:18
VLAI
EPSS
VEX
Title
BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:18 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1437 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.6.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104204",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:18:32.522646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:18:52.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:44:09.471Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1437",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1437"
}
],
"source": {
"advisory": "GHSA-hg85-pmm3-jfcf",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104204",
"datePublished": "2026-11-13T18:44:09.471Z",
"dateReserved": "2026-10-01T18:54:15.120Z",
"dateUpdated": "2026-11-13T21:18:52.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102612 (GCVE-0-2026-102612)
Vulnerability from nvd – Published: 2026-11-13 18:43 – Updated: 2026-11-13 18:43
VLAI
EPSS
VEX
Title
BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
8.1 (High)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1436 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:43:21.138Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-92q2-p4vr-fvmp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-92q2-p4vr-fvmp"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1436",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1436"
}
],
"source": {
"advisory": "GHSA-92q2-p4vr-fvmp",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102612",
"datePublished": "2026-11-13T18:43:21.138Z",
"dateReserved": "2026-09-29T14:18:02.921Z",
"dateUpdated": "2026-11-13T18:43:21.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102537 (GCVE-0-2026-102537)
Vulnerability from nvd – Published: 2026-11-13 18:41 – Updated: 2026-11-13 18:41
VLAI
EPSS
VEX
Title
bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1434 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:41:50.301Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jgm4-2wg9-jwfg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jgm4-2wg9-jwfg"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1434",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1434"
}
],
"source": {
"advisory": "GHSA-jgm4-2wg9-jwfg",
"discovery": "UNKNOWN"
},
"title": "bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102537",
"datePublished": "2026-11-13T18:41:50.301Z",
"dateReserved": "2026-09-29T13:00:21.388Z",
"dateUpdated": "2026-11-13T18:41:50.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100403 (GCVE-0-2026-100403)
Vulnerability from nvd – Published: 2026-11-13 18:41 – Updated: 2026-11-13 18:41
VLAI
EPSS
VEX
Title
BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1433 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub\u0027s Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:41:06.709Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4vgv-v5ph-rmxr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4vgv-v5ph-rmxr"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1433",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1433"
}
],
"source": {
"advisory": "GHSA-4vgv-v5ph-rmxr",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-100403",
"datePublished": "2026-11-13T18:41:06.709Z",
"dateReserved": "2026-09-25T20:08:33.083Z",
"dateUpdated": "2026-11-13T18:41:06.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62974 (GCVE-0-2026-62974)
Vulnerability from nvd – Published: 2026-11-13 16:00 – Updated: 2026-11-13 16:00
VLAI
EPSS
VEX
Title
BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
CWE
- CWE-835 - Loop with Unreachable Exit Condition
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1410 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:00:10.321Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2c8x-f46r-8phh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2c8x-f46r-8phh"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1410",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1410"
}
],
"source": {
"advisory": "GHSA-2c8x-f46r-8phh",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62974",
"datePublished": "2026-11-13T16:00:10.321Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T16:00:10.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62973 (GCVE-0-2026-62973)
Vulnerability from nvd – Published: 2026-11-13 15:59 – Updated: 2026-11-13 21:08
VLAI
EPSS
VEX
Title
BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:08 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1395 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62973",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:08:38.040564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:08:56.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:59:09.431Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1395",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1395"
}
],
"source": {
"advisory": "GHSA-3xxw-jfwm-rq9c",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62973",
"datePublished": "2026-11-13T15:59:09.431Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T21:08:56.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62972 (GCVE-0-2026-62972)
Vulnerability from nvd – Published: 2026-11-13 15:58 – Updated: 2026-11-13 15:58
VLAI
EPSS
VEX
Title
BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1412 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to \u0026apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller\u0027s buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:58:33.986Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1412",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1412"
}
],
"source": {
"advisory": "GHSA-9hq3-w3pc-8385",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62972",
"datePublished": "2026-11-13T15:58:33.986Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T15:58:33.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58498 (GCVE-0-2026-58498)
Vulnerability from nvd – Published: 2026-11-13 15:57 – Updated: 2026-11-13 15:57
VLAI
EPSS
VEX
Title
BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
8.6 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1392 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:57:47.797Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1392",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1392"
}
],
"source": {
"advisory": "GHSA-4p4w-m434-jrhj",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58498",
"datePublished": "2026-11-13T15:57:47.797Z",
"dateReserved": "2026-06-30T20:21:25.813Z",
"dateUpdated": "2026-11-13T15:57:47.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58265 (GCVE-0-2026-58265)
Vulnerability from nvd – Published: 2026-11-13 15:58 – Updated: 2026-11-13 15:58
VLAI
EPSS
VEX
Title
BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
6.5 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1396 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option\u0027s declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:58:11.001Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1396",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1396"
}
],
"source": {
"advisory": "GHSA-j66x-fr38-r7m5",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58265",
"datePublished": "2026-11-13T15:58:11.001Z",
"dateReserved": "2026-06-29T21:54:30.331Z",
"dateUpdated": "2026-11-13T15:58:11.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52790 (GCVE-0-2026-52790)
Vulnerability from nvd – Published: 2026-11-13 15:57 – Updated: 2026-11-13 21:07
VLAI
EPSS
VEX
Title
BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:07 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1375 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52790",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:07:26.266952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:07:45.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-562",
"description": "CWE-562: Return of Stack Variable Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:57:10.497Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1375",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1375"
}
],
"source": {
"advisory": "GHSA-jr7p-rm2x-739x",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52790",
"datePublished": "2026-11-13T15:57:10.497Z",
"dateReserved": "2026-06-08T18:02:19.731Z",
"dateUpdated": "2026-11-13T21:07:45.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52789 (GCVE-0-2026-52789)
Vulnerability from nvd – Published: 2026-11-13 15:56 – Updated: 2026-11-13 15:56
VLAI
EPSS
VEX
Title
BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
7.5 (High)
CWE
- CWE-835 - Loop with Unreachable Exit Condition
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1374 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack\u0027s ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:56:44.502Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1374",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1374"
}
],
"source": {
"advisory": "GHSA-4rf9-4vgq-5gcw",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52789",
"datePublished": "2026-11-13T15:56:44.502Z",
"dateReserved": "2026-06-08T18:02:19.731Z",
"dateUpdated": "2026-11-13T15:56:44.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52788 (GCVE-0-2026-52788)
Vulnerability from nvd – Published: 2026-11-13 15:56 – Updated: 2026-11-13 15:56
VLAI
EPSS
VEX
Title
BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Two bugs cause out-of-bounds writes past the utf8_urls[10][129] array in the static BSC_ADDRESS_RESOLUTION structure. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1365 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Two bugs cause out-of-bounds writes past the utf8_urls[10][129] array in the static BSC_ADDRESS_RESOLUTION structure. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:56:05.655Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rf83-3rr5-v4mj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rf83-3rr5-v4mj"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1365",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1365"
}
],
"source": {
"advisory": "GHSA-rf83-3rr5-v4mj",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52788",
"datePublished": "2026-11-13T15:56:05.655Z",
"dateReserved": "2026-06-08T18:02:19.731Z",
"dateUpdated": "2026-11-13T15:56:05.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52787 (GCVE-0-2026-52787)
Vulnerability from nvd – Published: 2026-11-13 15:54 – Updated: 2026-11-13 15:54
VLAI
EPSS
VEX
Title
BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2.
Severity
7.5 (High)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1363 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 Affected: < 1.6.0-rc2 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003c 1.6.0-rc2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131: Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:54:51.243Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1363",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1363"
}
],
"source": {
"advisory": "GHSA-4fgg-fghm-jm43",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52787",
"datePublished": "2026-11-13T15:54:51.243Z",
"dateReserved": "2026-06-08T18:02:19.730Z",
"dateUpdated": "2026-11-13T15:54:51.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49990 (GCVE-0-2026-49990)
Vulnerability from nvd – Published: 2026-11-13 15:54 – Updated: 2026-11-13 21:07
VLAI
EPSS
VEX
Title
BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:06 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1362 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
>= 1.4.2, < 1.4.5
Affected: >= 1.5.0, < 1.5.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49990",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:06:41.375503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:07:01.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.4.2, \u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:54:22.681Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1362",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1362"
}
],
"source": {
"advisory": "GHSA-8759-hx7g-94qx",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49990",
"datePublished": "2026-11-13T15:54:22.681Z",
"dateReserved": "2026-06-02T18:30:51.282Z",
"dateUpdated": "2026-11-13T21:07:01.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64675 (GCVE-0-2026-64675)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:51 – Updated: 2026-11-13 21:19
VLAI
EPSS
VEX
Title
BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:19 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1386 | x_refsource_MISC |
| https://github.com/bacnet-stack/bacnet-stack/pull/1387 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.5
Affected: < 1.5.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64675",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:19:09.622280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:19:27.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
},
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:51:06.844Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1386",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1386"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1387",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1387"
}
],
"source": {
"advisory": "GHSA-mmg6-p4pr-cj6h",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-64675",
"datePublished": "2026-11-13T18:51:06.844Z",
"dateReserved": "2026-07-20T17:12:12.891Z",
"dateUpdated": "2026-11-13T21:19:27.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104204 (GCVE-0-2026-104204)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:44 – Updated: 2026-11-13 21:18
VLAI
EPSS
VEX
Title
BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:18 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1437 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.6.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104204",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:18:32.522646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:18:52.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:44:09.471Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1437",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1437"
}
],
"source": {
"advisory": "GHSA-hg85-pmm3-jfcf",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104204",
"datePublished": "2026-11-13T18:44:09.471Z",
"dateReserved": "2026-10-01T18:54:15.120Z",
"dateUpdated": "2026-11-13T21:18:52.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102612 (GCVE-0-2026-102612)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:43 – Updated: 2026-11-13 18:43
VLAI
EPSS
VEX
Title
BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
8.1 (High)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1436 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:43:21.138Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-92q2-p4vr-fvmp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-92q2-p4vr-fvmp"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1436",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1436"
}
],
"source": {
"advisory": "GHSA-92q2-p4vr-fvmp",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102612",
"datePublished": "2026-11-13T18:43:21.138Z",
"dateReserved": "2026-09-29T14:18:02.921Z",
"dateUpdated": "2026-11-13T18:43:21.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97692 (GCVE-0-2026-97692)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:42 – Updated: 2026-11-13 18:42
VLAI
EPSS
VEX
Title
BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
7.7 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1435 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option\u0027s MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer\u0027s prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:42:41.703Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-gr74-333w-7wg8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-gr74-333w-7wg8"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1435",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1435"
}
],
"source": {
"advisory": "GHSA-gr74-333w-7wg8",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-97692",
"datePublished": "2026-11-13T18:42:41.703Z",
"dateReserved": "2026-09-24T21:43:37.208Z",
"dateUpdated": "2026-11-13T18:42:41.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102537 (GCVE-0-2026-102537)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:41 – Updated: 2026-11-13 18:41
VLAI
EPSS
VEX
Title
bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1434 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:41:50.301Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jgm4-2wg9-jwfg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jgm4-2wg9-jwfg"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1434",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1434"
}
],
"source": {
"advisory": "GHSA-jgm4-2wg9-jwfg",
"discovery": "UNKNOWN"
},
"title": "bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102537",
"datePublished": "2026-11-13T18:41:50.301Z",
"dateReserved": "2026-09-29T13:00:21.388Z",
"dateUpdated": "2026-11-13T18:41:50.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100403 (GCVE-0-2026-100403)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:41 – Updated: 2026-11-13 18:41
VLAI
EPSS
VEX
Title
BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1433 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.4.6
Affected: >= 1.5.0, < 1.5.2 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.2"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub\u0027s Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:41:06.709Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4vgv-v5ph-rmxr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4vgv-v5ph-rmxr"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1433",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1433"
}
],
"source": {
"advisory": "GHSA-4vgv-v5ph-rmxr",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-100403",
"datePublished": "2026-11-13T18:41:06.709Z",
"dateReserved": "2026-09-25T20:08:33.083Z",
"dateUpdated": "2026-11-13T18:41:06.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82414 (GCVE-0-2026-82414)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:40 – Updated: 2026-11-13 21:18
VLAI
EPSS
VEX
Title
BACnet Stack: MS/TP COBS decode overflow
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:17 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1425 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
>= 1.4.0, < 1.4.6
Affected: >= 1.5.0, < 1.5.1 Affected: >= 1.6.0, < 1.6.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82414",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:17:48.680575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:18:08.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.4.0, \u003c 1.4.6"
},
{
"status": "affected",
"version": "\u003e= 1.5.0, \u003c 1.5.1"
},
{
"status": "affected",
"version": "\u003e= 1.6.0, \u003c 1.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:40:31.749Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1425",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1425"
}
],
"source": {
"advisory": "GHSA-8456-m9x4-j6mc",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: MS/TP COBS decode overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-82414",
"datePublished": "2026-11-13T18:40:31.749Z",
"dateReserved": "2026-08-28T22:00:43.514Z",
"dateUpdated": "2026-11-13T21:18:08.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62977 (GCVE-0-2026-62977)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:40 – Updated: 2026-11-13 18:40
VLAI
EPSS
VEX
Title
BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1411 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.5.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908: Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:40:09.732Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1411",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1411"
}
],
"source": {
"advisory": "GHSA-mwj7-2v5r-v934",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62977",
"datePublished": "2026-11-13T18:40:09.732Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T18:40:09.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62976 (GCVE-0-2026-62976)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:39 – Updated: 2026-11-13 18:39
VLAI
EPSS
VEX
Title
BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1408 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.5.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:39:25.636Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-32jj-x86x-w98w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-32jj-x86x-w98w"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1408"
}
],
"source": {
"advisory": "GHSA-32jj-x86x-w98w",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62976",
"datePublished": "2026-11-13T18:39:25.636Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T18:39:25.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62975 (GCVE-0-2026-62975)
Vulnerability from cvelistv5 – Published: 2026-11-13 18:38 – Updated: 2026-11-13 18:38
VLAI
EPSS
VEX
Title
BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read
Summary
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bacnet-stack/bacnet-stack/secu… | x_refsource_CONFIRM |
| https://github.com/bacnet-stack/bacnet-stack/pull/1408 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bacnet-stack | bacnet-stack |
Affected:
< 1.5.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bacnet-stack",
"vendor": "bacnet-stack",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:38:57.163Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv"
},
{
"name": "https://github.com/bacnet-stack/bacnet-stack/pull/1408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bacnet-stack/bacnet-stack/pull/1408"
}
],
"source": {
"advisory": "GHSA-cf8g-hp9m-9fvv",
"discovery": "UNKNOWN"
},
"title": "BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62975",
"datePublished": "2026-11-13T18:38:57.163Z",
"dateReserved": "2026-07-14T22:48:09.780Z",
"dateUpdated": "2026-11-13T18:38:57.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}