bacnet-stack BACnet Stack up to 1.4.3/1.5.0 AtomicReadFile fileData out-of-bounds

Summaryinfo

A vulnerability identified as problematic has been detected in bacnet-stack BACnet Stack up to 1.4.3/1.5.0. Impacted is an unknown function of the component AtomicReadFile. The manipulation of the argument fileData leads to out-of-bounds. This vulnerability is traded as CVE-2026-46677. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in bacnet-stack BACnet Stack up to 1.4.3/1.5.0. This issue affects some unknown functionality of the component AtomicReadFile. The manipulation of the argument fileData with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. The summary by CVE is:

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-46677 since 05/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 1.4.4 or 1.5.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• bacnet-stack

Name

• BACnet Stack

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.5.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion