Denial of Service and Memory Corruption Risk in BACnet Stack by BACnet Protocol
CVE-2026-49990

8.6HIGH

Key Information:

Vendor

Bacnet-stack

Status
Bacnet-stack
Vendor
CVE Published:
13 November 2026

What is CVE-2026-49990?

BACnet Stack, an open source BACnet protocol stack library for embedded systems, presents a vulnerability in versions 1.4.2 through 1.4.4 and 1.5.0. The issue stems from insufficient validation of a signed fileStartPosition derived from AtomicReadFile and AtomicWriteFile stream-access requests. This flaw can lead to significant operational disruptions, including a reliable denial of service through process crashes, exposure of sensitive adjacent memory content, or the potential corruption of heap memory, ultimately destabilizing the affected process. Users are advised to upgrade to patched versions 1.4.5 and 1.5.1 to mitigate these risks.

Affected Version(s)

bacnet-stack >= 1.4.2, < 1.4.5 < 1.4.2, 1.4.5

bacnet-stack >= 1.5.0, < 1.5.1 < 1.5.0, 1.5.1

References

https://github.com/bacnet-stack/bacnet-stack/security/adv...
x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/pull/1362
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.