{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"cveId":"CVE-2026-62972","cwes":["CWE-125"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794585513986,"publishedAt":1794585513986,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1412"}],"remediation":[],"revision":"9decd98d1631e15279f408416d018ee7532e233eeb2f4c0abcd296468ec8ab7a","sources":[{"modifiedAt":1794585513986,"name":"CNA: GitHub_M","retrievedAt":1794586332588,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62972"}],"ssvc":null,"status":"published","title":"BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)","updatedAt":1794586332588}