CVE-2026-62976
Received Received - Intake

Heap Buffer Overflow in BACnet Stack Library

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-62976
EUVD
EUVD-2026-125691

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bacnet_stack bacnet_stack to 1.5.1 (inc)
bacnet_stack bacnet_stack to 1.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the BACnet Stack library before version 1.5.1. It involves a flaw in the RAMFS-backed FILE object implementation where appended records are stored as NUL-terminated strings. The record-counting logic incorrectly assumes an extra empty record exists, leading to a buffer over-read when processing two consecutive AtomicWriteFile append requests.

Impact Analysis

This vulnerability could allow an attacker to cause a buffer over-read, potentially leading to crashes, data corruption, or unintended behavior in systems using the affected BACnet Stack versions. It may enable denial-of-service conditions or unauthorized memory access.

Mitigation Strategies

Update the BACnet Stack library to version 1.5.1 or later to patch the vulnerability. If using embedded systems, verify the firmware or application uses the patched version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...