CVE-2026-45265 in BACnet Stack
Summary
by MITRE • 11/12/2026
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/12/2026
The BACnet Stack library serves as an open-source C implementation of the Building Automation and Control Networks protocol, designed for integration into embedded systems within industrial control environments. A critical security flaw exists within this stack prior to versions 1.4.4 and 1.5.1, specifically involving a stack-based out-of-bounds write vulnerability triggered during the processing of Atomic-Read-File requests in record access mode. This vulnerability is classified under CWE-121 as a Stack-Based Buffer Overflow, which represents one of the most dangerous classes of memory corruption errors due to its potential for arbitrary code execution and system compromise. The flaw manifests when an attacker crafts a malicious request that sets an excessively large RecordCount value within the protocol message structure.
Upon receiving this crafted request, the server-side implementation fails to adequately validate the size of the incoming data against the capacity of the local stack-allocated variable BACNET_ATOMIC_READ_FILE_DATA. This structure is statically defined with space for only a single fileData element. However, the code proceeds to use the unvalidated RecordCount as the upper bound for a loop intended to write record data into this array. When the iteration index reaches one, the pointer arithmetic computes an address corresponding to &data->fileData[1], which lies outside the allocated bounds of the stack buffer. This invalid memory location is subsequently passed to the memmove function, resulting in a direct overwrite of adjacent stack memory and causing a severe stack-buffer-overflow condition.
The operational impact of this vulnerability is significant for any organization relying on BACnet-enabled devices such as HVAC controllers, access control systems, or energy management units that utilize this specific library version. An attacker with network access to the affected device can exploit this flaw by sending specially crafted packets over the BACnet/IP interface. Successful exploitation allows an adversary to overwrite critical stack data including return addresses and saved frame pointers, potentially leading to remote code execution with the privileges of the compromised process. In embedded systems where such services often run with elevated permissions or limited security controls, this can result in full device compromise, allowing for unauthorized control over physical infrastructure processes. This attack vector aligns with ATT&CK technique T1059 Command and Scripting Interpreter if the overflow leads to code execution that spawns shells or scripts, and it relates to T1203 Exploitation for Defense Evasion if used to bypass security mechanisms during an intrusion chain.
Mitigation strategies primarily involve upgrading the BACnet Stack library to version 1.4.4 or later where this issue has been patched through improved input validation and bounds checking logic. Organizations should audit their inventory of embedded devices to identify those running vulnerable versions of the stack and prioritize updates accordingly. In environments where immediate patching is not feasible, network segmentation strategies can be employed to restrict access to BACnet services from untrusted networks or hosts. Additionally, deploying intrusion detection systems capable of identifying anomalous packet sizes in BACnet traffic may provide an additional layer of defense against exploitation attempts while remediation efforts are underway.