Out-of-Bounds Read Vulnerability in BACnet Stack C Library: Affected Versions and Impact
CVE-2026-62972

6.9MEDIUM

Key Information:

Vendor

Bacnet-stack

Status
Bacnet-stack
Vendor
CVE Published:
13 November 2026

What is CVE-2026-62972?

The BACnet Stack, an open-source protocol stack C library intended for embedded systems, contains a vulnerability that allows for out-of-bounds reads. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the lighting_command_decode function improperly decodes data when handling the APDU size. This oversight leads the nested decoders to read beyond the intended buffer limit, exposing applications to potential data leakage or crashes. The issue has been addressed in the specified updated versions.

Affected Version(s)

bacnet-stack < 1.4.5 < 1.4.5

bacnet-stack < 1.5.1 < 1.5.1

bacnet-stack < 1.6.0 < 1.6.0

References

https://github.com/bacnet-stack/bacnet-stack/security/adv...
x_refsource_CONFIRM
https://github.com/bacnet-stack/bacnet-stack/pull/1412
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.