{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":">= 1.4.2, < 1.4.5"},{"status":"affected","version":">= 1.5.0, < 1.5.1"}]}],"cveId":"CVE-2026-49990","cwes":["CWE-125","CWE-787"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"}],"modifiedAt":1794585262681,"publishedAt":1794585262681,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1362"}],"remediation":[],"revision":"c94d6339ca6d5b7f84c14abbbd124878fb0526d3e8ae5701a772edee40de884d","sources":[{"modifiedAt":1794585262681,"name":"CNA: GitHub_M","retrievedAt":1794586284094,"url":"https://www.cve.org/CVERecord?id=CVE-2026-49990"}],"ssvc":null,"status":"published","title":"BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends","updatedAt":1794586284094}