Is CVE-2026-46674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46674 being exploited in the wild.

How severe is CVE-2026-46674?

High severity, with a CVSS score of 7.5, published 12 November 2026.

Which products and versions are affected?

BACnet Stack Project BACnet Stack before 1.4.4 and 1.5.1.

Is there a fix for CVE-2026-46674?

Yes: fixed in 1.4.4, 1.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46674 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46674?

Check whether you run BACnet Stack Project BACnet Stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46674: BACnet Stack out-of-bounds read in AtomicWriteFile

CVE-2026-46674 · Severity: high · CVSS 7.5 · Published 2026-11-12

BACnet Stack is a protocol library used in building automation and industrial control systems. A vulnerability in its AtomicWriteFile request handler allows a remote attacker to read beyond allocated memory on the server, potentially causing system crashes or exposing sensitive data from memory. The flaw can be triggered by sending a crafted network message without authentication.

Technologies: BACnet Stack Project BACnet Stack. Vendors: BACnet Stack Project.

Quick answers

Is CVE-2026-46674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46674 being exploited in the wild.
How severe is CVE-2026-46674?: High severity, with a CVSS score of 7.5, published 12 November 2026.
Which products and versions are affected?: BACnet Stack Project BACnet Stack before 1.4.4 and 1.5.1.
Is there a fix for CVE-2026-46674?: Yes: fixed in 1.4.4, 1.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46674 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46674?: Check whether you run BACnet Stack Project BACnet Stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.4, 1.5.1

Technical details

An out-of-bounds read in the AtomicWriteFile record-access decoder (awf_decode_service_request) results from an externally controlled returnedRecordCount value that exceeds the fixed-size fileData[] array capacity (1 element by default in BACNET_ATOMIC_WRITE_FILE_DATA). The decoder accepts the oversized count without validation, and later code paths iterate using this untrusted count, accessing stack memory beyond the allocated structure. The vulnerability is reachable pre-authentication via network-facing BACnet service dispatch and is triggered by crafted incoming requests.

Affected products

BACnet Stack project BACnet Stack before 1.4.4 and 1.5.1

Timeline

2026-11-12: disclosed
2026-05-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.