Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-42805

Quick assessment

Affected
Bosch Sensortec BHI385 SensorAPI (C Library)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

博世森索泰克（Bosch Sensortec）BHI385 SensorAPI（C 语言库）中的调试消息解析函数 （位于 ）中存在一个基于堆栈的缓冲区溢出漏洞。 该函数在解析 FIFO 事件时，直接从受攻击者控制的事件载荷中读取一个 8 位的消息长度（ ），但未进行边界检查或对长度值进行截断（clamping）。 当通过 将载荷复制到大小为 17 字节的固定大小堆栈缓冲区（ ）时，如果提供的长度字节大于 16，函数会写入超出已分配堆栈边界的内存区域。 这种内存损坏可由恶意或已被攻陷的传感器或总线参与者触发，可能导致

CVSS 8.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-42805

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in bhi385_parse.c). The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without enforcing bounds checks or clamping the value. When copying the payload into a fixed-size stack buffer of 17 bytes (uint8_t debug_msg[17]) via memcpy, providing a length byte greater than 16 causes the function to write past the allocated stack boundary. This memory corruption can be triggered by a malicious or compromised sensor or bus participant, leading to a firmware crash, Denial of Service (DoS), or potentially the execution of arbitrary code via adjacent stack data corruption.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Bosch Sensortec BHI385 SensorAPI (C Library) 1.1.0 ~ 2.1.0 -

II. Public POCs for CVE-2026-42805

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-42805

请登录查看更多情报信息。

Other References for CVE-2026-42805 (1)

Same Patch Batch · Bosch Sensortec · 2026-09-10 · 5 CVEs total

CVE-2026-42807 8.0 HIGH BoschSensortec COINES_SDK 2.10-2.12.2 堆缓冲区溢出
CVE-2026-42804 7.6 HIGH CVE-2026-42804
CVE-2026-42808 6.8 MEDIUM Bosch COINES_SDK 2.0-2.11 流式读取缓冲区溢出
CVE-2026-42806 4.3 MEDIUM Bosch BME690 v1.0.3 越界读取漏洞

IV. Related Vulnerabilities

Same vendor: Bosch Sensortec
Same weakness: CWE-121

V. Comments for CVE-2026-42805

No comments yet

Leave a comment