{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.5.1"}]}],"cveId":"CVE-2026-62975","cwes":["CWE-125"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794595137163,"publishedAt":1794595137163,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1408"}],"remediation":[],"revision":"f1fcd94216463dfe8c037c311d1abbf61becfc22ed62fa23002d3fb5c26af36c","sources":[{"modifiedAt":1794595137163,"name":"CNA: GitHub_M","retrievedAt":1794597934767,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62975"}],"ssvc":null,"status":"published","title":"BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read","updatedAt":1794597934767}