CVE-2026-42804

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.

The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360 parse debug message() in bhi360 parse.c (lines 1852-1875).

The parser trusts the first payload byte of a debug frame as the message length (msg length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug msg) via memcpy without performing any bounds checking.

A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16.

This corrupts adjacent stack data, including the saved return address.

Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).