---
id: CVE-2026-42808
title: "An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.\_\r\n\r\nThe host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer.\r\n\r\nInte…"
summary: "An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.\_\r\n\r\nThe host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer.\r\n\r\nInte…"
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-120
vendor: Bosch Sensortec
product: COINES_SDK
affected:
  - COINES_SDK >= 2.0 <= 2.11
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:43:03.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42808'
references:
  - url: 'https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html'
    label: psirt@bosch.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T13:17:29.757002Z'
ingestedAt: '2026-09-10T09:45:12.029Z'
epss: 0.00265
epssPercentile: 0.16335
---

## Overview

An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. 

The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer.

Internally, the stream processing mechanism in {{comm_intf_process_stream_response()}} discards the requested {{number_of_samples}} argument and copies the entirety of the streaming ring buffer's accumulated data into {{coines_stream_rsp_buf}}.

Subsequently, {{coines_read_stream_sensor_data()}} unconditionally executes a {{memcpy}} of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough.

A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment.

This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.