Bosch Sensortec BHI360 SensorAPI FIFO Parsing bhi360_parse.c bhi360_parse_debug_message msg_length stack-based overflow

Summaryinfo

A vulnerability was found in Bosch Sensortec BHI360 SensorAPI. It has been declared as very critical. The impacted element is the function bhi360_parse_debug_message of the file bhi360_parse.c of the component FIFO Parsing. Such manipulation of the argument msg_length leads to stack-based overflow. This vulnerability is uniquely identified as CVE-2026-42804. Local access is required to approach this attack. No exploit exists. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in Bosch Sensortec BHI360 SensorAPI (version now known). It has been rated as very critical. Affected by this issue is the function bhi360_parse_debug_message of the file bhi360_parse.c of the component FIFO Parsing. The manipulation of the argument msg_length with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875). The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking. A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16. This corrupts adjacent stack data, including the saved return address. Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).

The advisory is available at psirt.bosch.com. This vulnerability is handled as CVE-2026-42804 since 04/30/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/10/2026).

Applying the patch d6b200416a is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Bosch Sensortec

Name

• BHI360 SensorAPI

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion