Executive brief
The Bosch Sensortec BHI360 SensorAPI is a C library that manages sensor data parsing and communication on embedded systems and microcontrollers. A stack buffer overflow in the debug message parser allows a locally or physically present attacker (via malicious sensor hardware or bus interception) to corrupt memory and execute arbitrary code or crash the system. This could compromise the integrity of any device using this library, including IoT sensors, wearables, and industrial control systems.
Technical details
A stack-based buffer overflow exists in the bhi360_parse_debug_message() function in bhi360_parse.c (lines 1852–1875). The function reads an untrusted 8-bit length field from the first payload byte of a debug frame and copies that many bytes into a fixed 17-byte stack buffer without bounds checking. An attacker with local or physical access (malicious sensor, counterfeit hardware, or MITM on I2C/SPI/BLE bus) can inject a crafted debug frame with a length byte exceeding 16, causing a stack overflow that corrupts the saved return address. The overflowed buffer is subsequently passed to printf-style logging, allowing format string attacks (e.g., %n) to leak memory or execute arbitrary code. The vulnerability affects BHI360 SensorAPI versions 2.1.0 through 2.1.x prior to commit d6b200416a.
Affected products
- Bosch Sensortec BHI360 SensorAPI 2.1.0 through 2.1.x prior to commit d6b200416a
Timeline
- 2026-09-10: disclosed: CVE-2026-42804 published
- patched: Fix available in updated API versions enforcing bounds checks on debug payloads