---
id: CVE-2026-42804
title: "A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.\r\n\r\nThe vulnerability is located within the FIFO parsing and debug logging subsystem …"
summary: "A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.\r\n\r\nThe vulnerability is located within the FIFO parsing and debug logging subsystem …"
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-121
vendor: Bosch Sensortec
product: BHI360_SensorAPI (C-Library)
affected:
  - bhi360_sensorapi_c-library >= 2.1.0 <= 2.2.0
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:17:12.070'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42804'
references:
  - url: 'https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html'
    label: psirt@bosch.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T15:01:43.170911Z'
ingestedAt: '2026-09-10T09:45:12.028Z'
epss: 0.00254
epssPercentile: 0.15011
---

## Overview

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.

The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875). 

The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking.

A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16.

This corrupts adjacent stack data, including the saved return address.

Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.