bacnet-stack BACnet Stack up to 1.4.4/1.5.0/1.5.x Lighting Command Decoder src/bacnet/lighting.c lighting_command_decode out-of-bounds

Summaryinfo

A vulnerability, which was classified as critical, was found in bacnet-stack BACnet Stack up to 1.4.4/1.5.0/1.5.x. Affected by this issue is the function lighting_command_decode of the file src/bacnet/lighting.c of the component Lighting Command Decoder. Executing a manipulation can lead to out-of-bounds. This vulnerability is tracked as CVE-2026-62972. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in bacnet-stack BACnet Stack up to 1.4.4/1.5.0/1.5.x and classified as critical. This vulnerability affects the function lighting_command_decode of the file src/bacnet/lighting.c of the component Lighting Command Decoder. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-62972 since 07/15/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.4.5, 1.5.1 or 1.6.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• bacnet-stack

Name

• BACnet Stack

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.5
• 1.5.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion