BACnet Stack up to 1.4.5/1.5.1/1.6.0 WebSocket Server realloc out-of-bounds write

Summaryinfo

A vulnerability labeled as problematic has been found in BACnet Stack up to 1.4.5/1.5.1/1.6.0. This affects the function realloc of the component WebSocket Server. Such manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2026-100403. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in BACnet Stack up to 1.4.5/1.5.1/1.6.0. Affected by this issue is the function realloc of the component WebSocket Server. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-100403 since 09/25/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.4.6, 1.5.2, 1.6.1 or 1.7.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• BACnet Stack

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.5
• 1.5.0
• 1.5.1
• 1.6.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion