CVE-2026-42804: Buffer Overflow
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage() in bhi360parse.c (lines 1852-1875). The parser trusts the first payload byte of a debug frame as the message length (msglength) and copies that many bytes into a fixed-size 17-byte stack buffer (debugmsg) via memcpy without performing any bounds checking. A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16. This corrupts adjacent stack data, including the saved return address. Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize devices where an attacker can physically access or intercept the sensor communication bus, or where sensor modules may be malicious, counterfeit, or otherwise untrusted. The described attack requires local or physical positioning rather than only interaction with the host application.
What input condition is required to trigger the overflow?
The attacker must inject a crafted debug frame whose first payload byte specifies a message length greater than 16. That value is used to copy data into a 17-byte stack buffer without bounds checking.
How can I determine whether a codebase is affected?
Review the incorporated BHI360 SensorAPI C-Library revision. Versions up to and including commit d6b200416a are affected, particularly code containing bhi360_parse_debug_message() in bhi360_parse.c.