{"id":"CVE-2026-42804","title":"A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.\r\n\r\nThe vulnerability is located within the FIFO parsing and debug logging subsystem …","summary":"A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.\r\n\r\nThe vulnerability is located within the FIFO parsing and debug logging subsystem …","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-121"],"vendor":"Bosch Sensortec","product":"BHI360_SensorAPI (C-Library)","affected":["bhi360_sensorapi_c-library >= 2.1.0 <= 2.2.0"],"published":"2026-09-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T16:17:12.070","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42804","references":[{"url":"https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html","label":"psirt@bosch.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T15:01:43.170911Z"},"ingestedAt":"2026-09-10T09:45:12.028Z","epss":0.00254,"epssPercentile":0.17154,"slug":"CVE-2026-42804","body":"## Overview\n\nA stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.\r\n\r\nThe vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875). \r\n\r\nThe parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking.\r\n\r\nA locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16.\r\n\r\nThis corrupts adjacent stack data, including the saved return address.\r\n\r\nFurthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}