CVE-2026-42806 in BME690 SensorAPI
Summary
by MITRE • 09/10/2026
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).
The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.
When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).
An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.
This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.
The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
An out-of-bounds read vulnerability has been identified in the Bosch BME690 SensorAPI C-driver, affecting versions v1.0.3 and earlier. This flaw resides within the field data parsing logic of the read_all_field_data function located in bme69x.c. The driver architecture involves prefetching heater configuration registers into a contiguous thirty-byte stack buffer named set_val, which is designed to map IDAC, RES_HEAT, and GAS_WAIT tables for sensor operation. While this design facilitates efficient access to hardware parameters during initialization and calibration phases, it introduces significant risk when processing dynamic data returned by the physical sensor device over I2C or SPI interfaces.
The core technical flaw stems from insufficient boundary verification of the gas_index variable during runtime parsing operations. The driver extracts the gas index using a four-bit mask that allows values ranging from zero to fifteen. However, the valid operational range for this specific hardware component is restricted to indices between zero and nine. By failing to validate that the extracted gas_index falls within this acceptable subset before array access, the code permits out-of-bounds memory operations when the sensor or an intermediary device returns a value of ten or higher. This lack of input validation represents a fundamental failure in defensive programming practices expected from embedded system libraries handling hardware communication protocols.
An attacker capable of compromising the I2C or SPI bus can exploit this vulnerability by mimicking the BME690 sensor and returning malicious payloads containing elevated gas index values. Upon receiving such data, the driver executes an out-of-bounds array access at offset twenty plus the invalid gas_index value within the set_val buffer. This operation reads up to six bytes beyond the allocated stack memory boundary. The leaked byte is subsequently written into the public gas_wait field of the sensor output structure. Consequently, this leads to measurement corruption where application logic receives nonsensical or corrupted timing data for gas heating cycles. More critically, it results in information disclosure as adjacent stack memory contents are exposed through the telemetry stream or local logging mechanisms.
From a security classification perspective, this vulnerability aligns with CWE-125, which describes out-of-bounds read errors where software reads past the end of an allocated buffer. In terms of attack vectors and tactics, it relates to ATT&CK technique T1074, specifically data staged for collection or exfiltration via local storage if the leaked stack memory contains sensitive context such as return addresses, cryptographic keys, or other application state variables stored on the same stack frame. The impact extends beyond simple denial of service due to potential crashes; it poses a tangible risk to confidentiality and integrity within resource-constrained IoT environments where robust input sanitization is often overlooked in favor of performance optimization.
Mitigation strategies must prioritize immediate software updates to version v1.0.4 or later, which includes the necessary bounds checking logic for gas_index validation before array access. For systems unable to update immediately, developers should implement a defensive wrapper around the read_all_field_data function that explicitly validates sensor responses against expected hardware constraints before passing them to the driver library. Additionally, enabling stack canaries and Address Sanitizer during development phases can help detect such memory corruption issues early in the lifecycle. Network segmentation of I2C or SPI buses is also recommended to prevent unauthorized devices from injecting malicious data into the communication channel between the microcontroller and the sensor module.