CVE-2026-42804: Buffer Overflow

Published Sep 10, 2026
·
Updated

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage() in bhi360parse.c (lines 1852-1875). The parser trusts the first payload byte of a debug frame as the message length (msglength) and copies that many bytes into a fixed-size 17-byte stack buffer (debugmsg) via memcpy without performing any bounds checking. A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16. This corrupts adjacent stack data, including the saved return address. Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).

Affected Software

1 affected component
Bosch Sensortec BHI360 SensorAPI (C-Library)<=d6b200416a

Event History

Sep 10, 2026
CVE Published
via MITRE·08:56 AM
Data Sourced
via MITRE·08:56 AM
DescriptionSeverity

Frequently Asked Questions

1

Which deployments should be prioritized for review?

Prioritize devices where an attacker can physically access or intercept the sensor communication bus, or where sensor modules may be malicious, counterfeit, or otherwise untrusted. The described attack requires local or physical positioning rather than only interaction with the host application.

2

What input condition is required to trigger the overflow?

The attacker must inject a crafted debug frame whose first payload byte specifies a message length greater than 16. That value is used to copy data into a 17-byte stack buffer without bounds checking.

3

How can I determine whether a codebase is affected?

Review the incorporated BHI360 SensorAPI C-Library revision. Versions up to and including commit d6b200416a are affected, particularly code containing bhi360_parse_debug_message() in bhi360_parse.c.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203