Uninitialized Value Use in BACnet Stack for Embedded Systems by BACnet
CVE-2026-46676

5.3MEDIUM

Key Information:

Vendor

Bacnet-stack

Status
Bacnet-stack
Vendor
CVE Published:
12 November 2026

What is CVE-2026-46676?

The BACnet Stack, an open-source C library for embedded systems, is impacted by an uninitialized value use vulnerability affecting versions 1.4.0 to 1.4.3 and 1.5.0. This vulnerability allows unauthenticated remote attackers to exploit the AtomicReadFile record-access ACK encoder, potentially leading to the corruption of the OCTET STRING length and payload boundaries in network responses. Attackers can achieve this by sending specially crafted AtomicReadFile requests. To mitigate this vulnerability, users are advised to update to versions 1.4.4 or 1.5.1, which contain the necessary patches to address this issue. For additional information, users can consult the advisories provided by the BACnet Stack development team.

Affected Version(s)

bacnet-stack >= 1.4.0, < 1.4.4 < 1.4.0, 1.4.4

bacnet-stack >= 1.5.0, < 1.5.1 < 1.5.0, 1.5.1

References

https://github.com/bacnet-stack/bacnet-stack/security/adv...
x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/pull/1344
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.