CVE-2026-42804
Quick assessment
Affected
Bosch Sensortec BHI360_SensorAPI (C-Library)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Bosch Sensortec BHI360 SensorAPI（C 库）中，存在一个基于栈的缓冲区溢出漏洞，影响版本至提交 及之前。 该漏洞位于 文件中 函数内的 FIFO 解析与调试日志子系统（第 1852–1875 行）。 解析器将调试帧的第一个载荷字节直接视为消息长度（ ），并通过 将该长度的字节数拷贝到一个固定大小为 17 字节的栈缓冲区（ ）中，且未进行任何边界检查。 本地或物理位置的攻击者（例如通过恶意传感器、假冒硬件模块，或在通信总线上实施中间人攻击）可以通过注入一个长度字节超过 16 的精心构
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42804
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.
The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875).
The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking.
A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16.
This corrupts adjacent stack data, including the saved return address.
Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Bosch Sensortec | BHI360_SensorAPI (C-Library) | 2.1.0 ~ 2.2.0 | - |
|
II. Public POCs for CVE-2026-42804
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42804
请登录查看更多情报信息。
Other References for CVE-2026-42804 (1)
-
https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html vendor-advisory
Same Patch Batch · Bosch Sensortec · 2026-09-10 · 5 CVEs total
| CVE-2026-42805 | 8.4 HIGH | BHI385 SensorAPI 栈缓冲区溢出 |
| CVE-2026-42807 | 8.0 HIGH | BoschSensortec COINES_SDK 2.10-2.12.2 堆缓冲区溢出 |
| CVE-2026-42808 | 6.8 MEDIUM | Bosch COINES_SDK 2.0-2.11 流式读取缓冲区溢出 |
| CVE-2026-42806 | 4.3 MEDIUM | Bosch BME690 v1.0.3 越界读取漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-121
-
CVE-2026-42805
BHI385 SensorAPI 栈缓冲区溢出 -
CVE-2026-88289
GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffe -
CVE-2026-88287
GV-LPC2011/LPC2211 -ONVIF Discovery Probe Scopes Stack-Frame -
CVE-2026-88284
GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Fr -
CVE-2026-88283
GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stac
V. Comments for CVE-2026-42804
No comments yet