A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage() in bhi360parse.c (lines 1852-1875). The parser trusts the first payload byte of a debug frame as the message length (msglength) and copies that many bytes into a fixed-size 17-byte stack buffer (debugmsg) via memcpy without performing any bounds checking. A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16. This corrupts adjacent stack data, including the saved return address. Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385parsedebugmessage (located in bhi385parse.c). The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callbackinfo->dataptr[0]) without enforcing bounds checks or clamping the value. When copying the payload into a fixed-size stack buffer of 17 bytes (uint8t debugmsg[17]) via memcpy, providing a length byte greater than 16 causes the function to write past the allocated stack boundary. This memory corruption can be triggered by a malicious or compromised sensor or bus participant, leading to a firmware crash, Denial of Service (DoS), or potentially the execution of arbitrary code via adjacent stack data corruption.

An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11.  The host streaming API function {{coinesreadstreamsensordata()}} fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in {{commintfprocessstreamresponse()}} discards the requested {{numberofsamples}} argument and copies the entirety of the streaming ring buffer's accumulated data into {{coinesstreamrspbuf}}. Subsequently, {{coinesreadstreamsensordata()}} unconditionally executes a {{memcpy}} of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough. A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment. This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.