BACnet Stack: Stack-based buffer overflow in Atomic-Read-File
The BACnet Stack C library contains a stack-based out-of-bounds write vulnerability in its handling of Atomic-Read-File requests in record access mode.
CVE search metadata
CVE search record: CVE-2026-45265. Severity: high. CVSS: 8.2. KEV: no. Brief: BACnet Stack: Stack-based buffer overflow in Atomic-Read-File. Brief link: https://feed.craftedsignal.io/briefs/2026-11-bacnet-stack-oob-write-cve-2026-45265/
Triage facts
Revision 1- Evidence
- Not observed
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
BACnet Stack contains a stack-based out-of-bounds write vulnerability in the library's handling of Atomic-Read-File requests in record access mode. A crafted request can set an excessively large RecordCount, which is used as a loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA structure that only has space for one element, resulting in an out-of-bounds memory write.