CVE-2026-62976 in BACnet Stack
Summary
by MITRE • 11/13/2026
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The BACnet Stack, an open-source C library designed for implementing the Building Automation and Control Networks protocol on embedded systems, contains a critical memory safety vulnerability within its RAMFS-backed FILE object implementation. This flaw specifically affects versions prior to 1.5.1 and was addressed in subsequent releases such as 1.6.0. The core of the issue lies in how the library manages appended records within heap-allocated buffers. When data is written to a file using this specific backend, the system stores these records as NUL-terminated strings. However, the internal logic responsible for counting the number of records present in the buffer operates under an incorrect assumption about memory layout and termination conditions.
The technical flaw manifests during the execution of record-counting operations following append requests. The implementation walks through the buffer to determine how many distinct records exist by checking for NUL terminators. Due to a logic error, the pointer arithmetic used to traverse this buffer advances one byte past the actual end of the heap allocation when processing consecutive writes. This off-by-one error means that subsequent calls to functions like bacnet_strnlen(), which are intended to measure string lengths safely up to a specified limit, receive a base pointer that is already invalid because it points beyond the allocated memory region.
This out-of-bounds read constitutes an Out-Of-Bounds Read vulnerability, classified under CWE-125 in common weakness enumerations. The operational impact of this flaw can be severe depending on the execution context and compiler behavior. Reading from unallocated heap memory typically results in undefined behavior, which may lead to application crashes or denial-of-service conditions if the read accesses unmapped pages. In more complex scenarios involving specific memory allocators or subsequent operations that rely on the corrupted state resulting from this invalid access, there is a potential risk of information disclosure where sensitive data residing adjacent to the buffer in heap memory could be leaked. Furthermore, while primarily described as an out-of-bounds read, such logic errors often serve as precursors to more severe exploitation vectors if combined with other vulnerabilities or specific runtime conditions that allow for control flow manipulation based on corrupted length values.
From a threat modeling perspective, this vulnerability aligns with techniques observed in the MITRE ATT&CK framework related to memory corruption and potential reconnaissance through information leakage. Attackers targeting embedded building automation systems could potentially exploit this instability to disrupt critical infrastructure operations or gather intelligence about the system's internal state. The BACnet protocol is widely used in HVAC controls, lighting, access control, and other industrial applications where reliability is paramount; therefore, any instability introduced by such memory errors poses a significant risk to operational continuity.
To mitigate this vulnerability, organizations utilizing versions of the BACnet Stack prior to 1.5.1 must upgrade immediately to version 1.5.1 or later, specifically recommending version 1.6.0 which includes comprehensive fixes for these logic errors. Developers integrating this library into embedded systems should also ensure that their build environments utilize static analysis tools capable of detecting off-by-one errors and out-of-bounds accesses in C code. Regular security audits focusing on memory management practices within protocol stacks are essential to maintain the integrity of building automation networks against both accidental failures and deliberate exploitation attempts.