{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"cveId":"CVE-2026-58265","cwes":["CWE-125"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"}],"modifiedAt":1794585491001,"publishedAt":1794585491001,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1396"}],"remediation":[],"revision":"a6f89385b0fecce2a4b3761d54d7226eb57c099a54128f6ae4f5a761e6b8ed32","sources":[{"modifiedAt":1794585491001,"name":"CNA: GitHub_M","retrievedAt":1794586299959,"url":"https://www.cve.org/CVERecord?id=CVE-2026-58265"}],"ssvc":null,"status":"published","title":"BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)","updatedAt":1794586299959}