CVE-2026-42806: Medium severity Bosch BME690 SensorAPI (C-driver) vulnerability
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in readallfielddata (bme69x.c). The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (setval) mapping IDAC, RESHEAT, and GASWAIT tables. When parsing sensor field data, the gasindex is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9). An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher. This causes the driver to perform an out-of-bounds array access (setval[20 + gasindex]), reading up to 6 bytes past the stack buffer. The leaked out-of-bounds byte is then written into the public gaswait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bosch BME690 SensorAPI (C-driver)to a version that resolves this vulnerability.Fixed in v1.0.3 and prior - Configuration
In read_all_field_data (bme69x.c), add boundary verification so gas_index is validated against the valid range (0..9) before it is used for set_val[20 + gas_index] and before writing leaked bytes into the public gas_wait field.
Bosch BME690 SensorAPI (C-driver) gas_index boundary verification (0..9) = Enforce that extracted gas_index from the 4-bit mask is within 0..9 before using it - Compensating control
If the attacker can mimic a peripheral on the I2C/SPI bus, use bus-level protections (e.g., physical access control, device whitelisting/verification on the bus, and/or restricting which devices can respond) to prevent malicious/mimicked sensors from supplying crafted field data.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Bosch BME690 SensorAPI C-driver version v1.0.3 or earlier are affected when they communicate with a sensor or other device over I2C or SPI that can supply crafted field-data payloads.
What does an attacker need to exploit it?
An attacker needs the ability to act as, compromise, or otherwise emulate the sensor peripheral on the I2C/SPI bus. They must return field data containing a gas_index of 10 or greater.
What is the practical impact of a successful exploit?
The driver reads up to six bytes beyond its 30-byte stack buffer and places the resulting byte in the public gas_wait field. This can corrupt measurements and may expose adjacent stack memory if that field is logged or sent through telemetry.
How can I identify suspicious or malicious input?
Inspect sensor field-data responses for gas_index values outside the valid 0 through 9 range. Values of 10 through 15 trigger the out-of-bounds access.