{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.5.1"}]}],"cveId":"CVE-2026-62976","cwes":["CWE-125"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794595165636,"publishedAt":1794595165636,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-32jj-x86x-w98w"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1408"}],"remediation":[],"revision":"5f52c9577878b1215a09e11d0ff9d3e006bb9497aae0206cf252582614d55b17","sources":[{"modifiedAt":1794595165636,"name":"CNA: GitHub_M","retrievedAt":1794597935973,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62976"}],"ssvc":null,"status":"published","title":"BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend","updatedAt":1794597935973}