CVE-2026-42807: Buffer Overflow
A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINESSDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The bridge decoder ({{bridgedecoder.c}}) trusts the packet length field provided by the external device and forwards it to the host response queue ({{mqueueadddata}}) without validating the bounds of the destination buffer. A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral can advertise a payload size up to ~3 KB, which exceeds the default queue slot size of 255 bytes. This results in an unbounded heap overwrite ({{memcpy}}), corrupting adjacent heap metadata on the host system when processing the device's response.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Hosts using BoschSensortec COINES_SDK versions 2.10 through 2.12.2 are exposed when they process responses from an external USB or Bluetooth Low Energy peripheral through the PC bridge protocol decoder.
What does an attacker need to exploit it?
An attacker needs to control, compromise, or impersonate a USB or BLE peripheral that can send a crafted bridge-protocol response. No host-side privileges are required, but user interaction is required according to the provided severity vector.
Are default settings affected?
Yes. The reported malicious payload can be approximately 3 KB, while the default host response queue slot size is 255 bytes, allowing the packet length to exceed the destination buffer.
What is the impact of a successful exploit?
A crafted device response can overwrite heap memory on the host, causing a process crash. The vulnerability may also permit arbitrary code execution through corruption of adjacent heap metadata.