CVE-2026-46676
Received Received - Intake

Heap-based Buffer Overflow in BACnet Stack Library

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, an uninitialized value use vulnerability in bacnet-stack's AtomicReadFile record-access ACK encoder allows unauthenticated remote attackers to corrupt the encoded OCTET STRING length and payload boundary in network responses by sending a crafted AtomicReadFile request that reaches a successful record-access path. This issue has been patched in versions 1.4.4 and 1.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-46676
EUVD
EUVD-2026-124659

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46676 is an uninitialized value use vulnerability in the BACnet Stack's AtomicReadFile record-access ACK encoder. It allows unauthenticated remote attackers to corrupt the encoded OCTET STRING length and payload boundary in network responses by sending a crafted AtomicReadFile request. The flaw occurs because a stack-allocated object is used without ensuring each fileData[i] is fully initialized.

Detection Guidance

Detecting this vulnerability requires checking the version of bacnet-stack in use. Run 'bacnet-stack --version' or inspect the library files for version numbers between 1.4.0 to before 1.4.4 or 1.5.0 to before 1.5.1. Monitor network traffic for malformed AtomicReadFile responses, particularly those with abnormally large payloads or corrupted OCTET STRING data.

Use packet capture tools like tcpdump or Wireshark to analyze BACnet traffic for suspicious AtomicReadFile-ACK responses. Look for responses with unexpected lengths or corrupted data structures.

Impact Analysis

This vulnerability can cause response corruption in BACnet systems using File objects and the AtomicReadFile service. Attackers can force abnormally expanded responses, such as turning a 1-byte record into a 1481-byte encoded ACK. In some cases, it may also lead to conditional information disclosure.

Mitigation Strategies

Upgrade bacnet-stack to version 1.4.4 or 1.5.1 or later immediately. If upgrading is not possible, disable the AtomicReadFile confirmed service and File objects in BACnet deployments to prevent exploitation. Apply network-level mitigations such as firewalls or IDS rules to block malformed AtomicReadFile requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...