← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-cr23-59mg-h2rc: Coordinated Vulnerability Disclosure Verification Record (bacnet-stack/bacnet-stack)

[ACCEPTED BY VENDOR INTO DRAFT GHSA / UPSTREAM REMEDIATION PR #1595 OPEN]
Privately reported to bacnet-stack/bacnet-stack via GitHub Private Vulnerability Reporting (GHSA-cr23-59mg-h2rc) covering Pre-Auth Infinite Loop and OOB Read/Write via Negative Decode Length in Calendar_Write_Property() (src/bacnet/basic/object/calendar.c) and Notification_Class.
Accepted into draft state by lead maintainer Steve Karg (@skarg) on 2026-10-26 with official reporter credit to @ccsimplyspolit; upstream remediation Pull Request bacnet-stack/bacnet-stack#1595 (commit 76091b35a8, 36/36 CI checks passed) is currently open.

0x00 // GitHub CNA & Upstream Remediation Metadata

{
  "ghsa_id": "GHSA-cr23-59mg-h2rc",
  "repository": "bacnet-stack/bacnet-stack",
  "html_url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cr23-59mg-h2rc",
  "upstream_remediation_pr": "https://github.com/bacnet-stack/bacnet-stack/pull/1595",
  "state": "draft",
  "summary": "Pre-Auth Infinite Loop and OOB Read/Write via Negative Decode Length in Calendar_Write_Property() and Notification_Class",
  "status": "Accepted by Lead Maintainer (@skarg) into Draft GHSA / Upstream Fix PR #1595 Open",
  "severity": "high",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
  "created_at": "2026-10-25T12:59:06Z",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-125",
    "CWE-400",
    "CWE-787",
    "CWE-835"
  ],
  "specification_sha256_commitment": "fa34771bea681c5bfe19fc5526abfb05dfdb80adc9e679bf709d3fabcf1396e5"
}