CVE-2026-46676
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 12, 2026 · Last modified: Nov 12, 2026 · CWE-457
Not enough EPSS history yet.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, an uninitialized value use vulnerability in bacnet-stack's AtomicReadFile record-access ACK encoder allows unauthenticated remote attackers to corrupt the encoded OCTET STRING length and payload boundary in network responses by sending a crafted AtomicReadFile request that reaches a successful record-access path. This issue has been patched in versions 1.4.4 and 1.5.1.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1269157.5 HIG—
——0Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)11hCVE-2026-88822—8.8%
——3Issue summary: QUIC, when performing automated peer detection, may allow
uninitialized stack data to leak into the received address which is then used
as the destination for outgoing packets.
Impact summary: Applications using QUIC's automated peer detection mechanism
may receive an invalid address, leading to connection loss and disclosure of
uninitialized stack data to an attacker observing the outgoing network traffic.
CWE: CWE-457 (Use of Uninitialized Variable)
Description: The OpenSSL QUIC stack contains a feature in which, when using an
already connected socket, it will auto-detect the peer address during the SSL
handshake. This feature uses the getpeername() function, passing a buffer of
sufficient length to hold any supported address family, but passes a buffer
length that is only sized such that larger addresses, such as IPv6, cannot be
retrieved. The getpeername() function however, still returns the full address
length, which is accepted as the valid input buffer length, leading to the
address buffer containing uninitialized stack data instead of the actual peer
address. The invalid peer address is then used as destination for the outgoing
packets which leads to a connectivity breakage and a leakage of the
uninitialized stack data to passive network observers.
FIPS impact: no
The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as
the affected protocol is not implemented in the FIPS module.2dCVE-2026-1216116.5 MED47.3%
——14A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.2dCVE-2026-850682.4 LOW4.3%
——1Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.5hCVE-2026-54913—23.1%
——7WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.5hCVE-2026-118448—1.0%
——0A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.9d