{"id":"CVE-2026-42806","title":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater …","summary":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-125"],"vendor":"Bosch Sensortec","product":"BME690 SensorAPI (C)","affected":["bme690_sensorapi_c >= 1.0.1 <= 1.0.3"],"published":"2026-09-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T16:17:12.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42806","references":[{"url":"https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html","label":"psirt@bosch.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T15:00:33.822497Z"},"ingestedAt":"2026-09-10T09:45:12.028Z","epss":0.00154,"epssPercentile":0.04876,"slug":"CVE-2026-42806","body":"## Overview\n\nAn out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}