Bosch Sensortec COINES_SDK up to 2.12.2 PC bridge protocol decoder bridge_decoder.c mqueue_add_data buffer overflow

Summaryinfo

A vulnerability marked as problematic has been reported in Bosch Sensortec COINES_SDK up to 2.12.2. Affected by this issue is the function mqueue_add_data of the file bridge_decoder.c of the component PC bridge protocol decoder. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-42807. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability has been found in Bosch Sensortec COINES_SDK up to 2.12.2 and classified as problematic. Affected by this vulnerability is the function mqueue_add_data of the file bridge_decoder.c of the component PC bridge protocol decoder. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The bridge decoder ({{bridge_decoder.c}}) trusts the packet length field provided by the external device and forwards it to the host response queue ({{mqueue_add_data}}) without validating the bounds of the destination buffer. A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral can advertise a payload size up to ~3 KB, which exceeds the default queue slot size of 255 bytes. This results in an unbounded heap overwrite ({{memcpy}}), corrupting adjacent heap metadata on the host system when processing the device's response.

It is possible to read the advisory at psirt.bosch.com. This vulnerability is known as CVE-2026-42807 since 04/30/2026. The exploitation appears to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Bosch Sensortec

Name

• COINES_SDK

Version

• 2.12.0
• 2.12.1
• 2.12.2

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion