CVE-2026-62975

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.

• CWE-125

• https://github.com/bacnet-stack/bacnet-stack/pull/1408
• https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62968Dream Displays provides in-game screens for streaming videos…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-62971The OWASP core rule set (CRS) is a set of generic attack det…7.2
• CVE-2026-62972BACnet Stack is a BACnet open source protocol stack C librar…6.9
• CVE-2026-62973BACnet Stack is a BACnet open source protocol stack C librar…7.5
• CVE-2026-62974BACnet Stack is a BACnet open source protocol stack C librar…8.7
• CVE-2026-62976BACnet Stack is a BACnet open source protocol stack C librar…8.7
• CVE-2026-62977BACnet Stack is a BACnet open source protocol stack C librar…6.9
• CVE-2026-62979jack lets users share media libraries through their Radarr/S…8.4
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-62982Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-62985request-filtering-agent is an http(s).Agent implementation t…7.5