{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"}]}],"cveId":"CVE-2026-64675","cwes":["CWE-125"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794595866844,"publishedAt":1794595866844,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1386"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1387"}],"remediation":[],"revision":"f29c372dcdc11c302c3eef0552f9932ba8a002ed4f6fea80aeb22c10c41174ae","sources":[{"modifiedAt":1794595866844,"name":"CNA: GitHub_M","retrievedAt":1794597938401,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64675"}],"ssvc":null,"status":"published","title":"BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty","updatedAt":1794597938401}