# CVE-2026-46676: BACnet Stack uninitialized value use in AtomicReadFile encoder

Source: https://junglewise.ai/threats/cve-2026-46676-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-46676 · Severity: medium · CVSS 5.3 · Published 2026-11-12

BACnet Stack is a C library that implements the BACnet protocol used in building automation and HVAC systems. An uninitialized value vulnerability in the AtomicReadFile message encoder allows remote attackers to corrupt network responses or disclose memory contents by sending crafted requests to systems exposing File objects. Affected devices could experience response corruption, information leakage, or unexpected behavior in file-access operations.

Technologies: [BACnet Stack](https://junglewise.ai/threats/technologies/bacnet-stack-bacnet-stack). Vendors: [BACnet Stack](https://junglewise.ai/threats/vendors/bacnet-stack).

## Quick answers

**Is CVE-2026-46676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46676 being exploited in the wild.

**How severe is CVE-2026-46676?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** BACnet Stack 1.4.0 to 1.4.3, 1.5.0.

**Is there a fix for CVE-2026-46676?** Yes: fixed in 1.4.4, 1.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46676 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-46676?** Check whether you run BACnet Stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.4, 1.5.1

## Technical details

An uninitialized value use vulnerability exists in the AtomicReadFile record-access ACK encoder where stack-allocated BACNET_ATOMIC_READ_FILE_DATA objects are encoded without guaranteeing full initialization of BACNET_OCTET_STRING metadata. An unauthenticated remote attacker can send a crafted AtomicReadFile request that triggers a successful record-access path, causing the encoder to consume uninitialized length values that corrupt both the encoded OCTET STRING length semantics and payload copy boundary in network responses. On systems with partially initialized record buffers, this becomes a conditional information disclosure primitive. Patches are available in versions 1.4.4 and 1.5.1.

## Affected products

- BACnet Stack BACnet Stack 1.4.0 to 1.4.3, 1.5.0

## Timeline

- 2026-11-12: disclosed
- 2026-05-13: patched

## References

- [https://github.com/bacnet-stack/bacnet-stack/pull/1344](https://github.com/bacnet-stack/bacnet-stack/pull/1344)
- [https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2fwp-32cj-g3x4](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2fwp-32cj-g3x4)

## Related threats

- [BACnet Stack buffer overflow in EPICS app](https://junglewise.ai/threats/cve-2026-52786-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack stack buffer overflow in life-safety-zone property read](https://junglewise.ai/threats/cve-2026-47711-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack stack-based buffer overflow in RemoveListElement](https://junglewise.ai/threats/cve-2026-47259-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack stack-based buffer overflow in Notification Class AddListElement](https://junglewise.ai/threats/cve-2026-47258-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)
- [BACnet Stack restore logic flaw causes data loss](https://junglewise.ai/threats/cve-2026-47257-bacnet-stack-is-a-bacnet-open-source-protocol-stack-c-library-for)