Skip to main

Vulnerabilities in Bosch Sensortec SensorAPIs and COINES SDK

BOSCH-SA-223618

Advisory Information

Summary

Multiple vulnerabilities including stack-based buffer overflows, heap-based buffer overflows, and out-of-bounds reads have been identified in several Bosch Sensortec software components: the BHI360 SensorAPI, BHI385 SensorAPI, BME690 SensorAPI, and the COINES SDK.

Depending on the specific vulnerability, a locally/physically positioned attacker, or a compromised peripheral device (connected via I2C, SPI, USB, or BLE), can exploit these issues to cause a Denial of Service (system crash), leak sensitive stack memory, or potentially execute arbitrary code on the host system or microcontroller.

Affected Products

  • Bosch Sensortec COINES_SDK
    • CVE-2026-42807
      • Version(s): 2.10 < 2.12.2
    • CVE-2026-42808
      • Version(s): 2.0 < 2.11
  • Bosch Sensortec BHI385 SensorAPI (C Library)
    • CVE-2026-42805
      • Version(s): 1.1.0 < 2.1.0
  • Bosch Sensortec BME690 SensorAPI (C)
    • CVE-2026-42806
      • Version(s): 1.0.1 < 1.0.3
  • Bosch Sensortec BHI360_SensorAPI (C-Library)
    • CVE-2026-42804
      • Version(s): 2.1.0 < 2.2.0

Solution and Mitigations

Mitigation

Users of the affected Bosch Sensortec components are strongly advised to update to the latest patched software versions:

  • BHI360 / BHI385 SensorAPI: Apply the latest API updates enforcing bounds checks on debug payloads.
  • BME690 SensorAPI: Upgrade to version v1.0.4 or higher.
  • COINES SDK: Upgrade to version 2.12.3 or higher (fixes both the PC Bridge and Streaming API buffer validation issues).

Vulnerability Details

CVE-2026-42804

CVE Description: A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.

The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875).

The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking.

A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16.

This corrupts adjacent stack data, including the saved return address.

Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).

CVE-2026-42805

CVE Description: A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in bhi385_parse.c).

The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without enforcing bounds checks or clamping the value.

When copying the payload into a fixed-size stack buffer of 17 bytes (uint8_t debug_msg[17]) via memcpy, providing a length byte greater than 16 causes the function to write past the allocated stack boundary.

This memory corruption can be triggered by a malicious or compromised sensor or bus participant, leading to a firmware crash, Denial of Service (DoS), or potentially the execution of arbitrary code via adjacent stack data corruption.

CVE-2026-42806

CVE Description: An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).

The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.

When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).

An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.

This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.

The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.

CVE-2026-42807

CVE Description: A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code.

The bridge decoder (bridge_decoder.c) trusts the packet length field provided by the external device and forwards it to the host response queue (mqueue_add_data) without validating the bounds of the destination buffer.

A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral can advertise a payload size up to ~3 KB, which exceeds the default queue slot size of 255 bytes.

This results in an unbounded heap overwrite (memcpy), corrupting adjacent heap metadata on the host system when processing the device's response.

CVE-2026-42808

CVE Description: An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. 

The host streaming API function coines_read_stream_sensor_data() fails to validate the boundaries of the caller-provided destination buffer.

Internally, the stream processing mechanism in comm_intf_process_stream_response() discards the requested number_of_samples argument and copies the entirety of the streaming ring buffer's accumulated data into coines_stream_rsp_buf.

Subsequently, coines_read_stream_sensor_data() unconditionally executes a memcpy of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough.

A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment.

This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system. The CVSS environmental score is specific to each customer's environment and should be defined by the customer to attain a final scoring.

Additional Resources

Revision History

  • 31 Aug 2026: Initial Publication

Appendix

Acknowledgment

These vulnerabilities were identified using SecMate and responsibly reported by Maxime Rossi Bellom and Ramtine Tofighi Shirazi of SecMate.