CVE-2026-42806
Quick assessment
Affected
Bosch Sensortec BME690 SensorAPI (C)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Bosch BME690 传感器 API（C 语言驱动）v1.0.3 及更早版本中发现了一个越界读取漏洞，具体位于 中的 函数里的字段数据解析逻辑。 该驱动会预取加热器配置寄存器，并将其存储在一个连续的 30 字节栈缓冲区（ ）中，该缓冲区映射了 IDAC、RES_HEAT 和 GAS_WAIT 表。 在解析传感器字段数据时，系统使用 4 位掩码提取 （取值范围 0..15），但未对其有效范围（0..9）进行边界校验。 攻击者或一个在 I2C/SPI 总线上模拟传感器的被入侵外设，可以返回一个 值 ≥ 10 的
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42806
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).
The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.
When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).
An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.
This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.
The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Bosch Sensortec | BME690 SensorAPI (C) | 1.0.1 ~ 1.0.3 | - |
|
II. Public POCs for CVE-2026-42806
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42806
请登录查看更多情报信息。
Other References for CVE-2026-42806 (1)
-
https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html vendor-advisory
Same Patch Batch · Bosch Sensortec · 2026-09-10 · 5 CVEs total
| CVE-2026-42805 | 8.4 HIGH | BHI385 SensorAPI 栈缓冲区溢出 |
| CVE-2026-42807 | 8.0 HIGH | BoschSensortec COINES_SDK 2.10-2.12.2 堆缓冲区溢出 |
| CVE-2026-42804 | 7.6 HIGH | CVE-2026-42804 |
| CVE-2026-42808 | 6.8 MEDIUM | Bosch COINES_SDK 2.0-2.11 流式读取缓冲区溢出 |
IV. Related Vulnerabilities
Same weakness: CWE-125
-
CVE-2026-87875
Cups: openprinting cups: heap out-of-bounds read in cupsutf3 -
CVE-2026-22590
Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory -
CVE-2026-87824
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zst -
CVE-2026-73324
VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Rea -
CVE-2026-87795
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdD
V. Comments for CVE-2026-42806
No comments yet