Buffer Overflow Vulnerability in BACnet Stack by BACnet

CVE-2026-62976

What is CVE-2026-62976?

The BACnet Stack, an open-source protocol stack designed for embedded systems, contains a buffer overflow vulnerability due to improper handling of storage in its RAMFS-backed FILE object implementation. Specifically, prior to version 1.5.1, the record-counting logic inaccurately assumes the presence of an additional empty record, leading to potential exploitation through consecutive append requests to AtomicWriteFile. This flaw allows for the miscalculation of the allocated memory buffer length, potentially leading to unauthorized access or crashes. Users are encouraged to upgrade to versions 1.5.1 or 1.6.0, which include necessary patches to mitigate this risk.

References