CVE-2026-46677

Name of the Vulnerable Software and Affected Versions BACnet Stack versions prior to 1.4.4 BACnet Stack versions prior to 1.5.1

Description A client-side out-of-bounds read exists in the AtomicReadFile-ACK record-access handling path. The issue occurs due to a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET ATOMIC READ FILE DATA. The ACK decode path retains the remote RecordCount while discarding storage for excess records without truncating the count, leading a downstream sink to iterate over the original RecordCount and index fileData[i] out of bounds.

Recommendations Update to version 1.4.4 or later. Update to version 1.5.1 or later.