Executive brief
Bosch's BHI385 SensorAPI is a software library used to interface with motion and environmental sensor hardware. A flaw in the debug message parser allows a malicious or compromised sensor device to overflow a fixed-size buffer on the stack, potentially causing the host system or microcontroller to crash or enabling arbitrary code execution. An attacker would need physical access to the sensor bus or the ability to compromise the sensor device itself.
Technical details
A stack-based buffer overflow exists in the bhi385_parse_debug_message() function (bhi385_parse.c) where the parser extracts an 8-bit message length directly from attacker-controlled sensor event data without bounds checking. The extracted length is then used in a memcpy() operation to copy data into a fixed 17-byte stack buffer; a length value greater than 16 causes the write to overflow the buffer boundary. The vulnerability can be exploited by a locally positioned or physically adjacent attacker via a malicious or compromised sensor connected on I2C, SPI, USB, or BLE. Exploitation leads to stack memory corruption, firmware crash, denial of service, or potentially arbitrary code execution. Bosch recommends upgrading to version 2.1.0 or later.
Affected products
- Bosch Sensortec BHI385 SensorAPI 1.1.0 to <2.1.0
Timeline
- 2026-09-10: disclosed
- 2026-08-31: patched: Patched version 2.1.0 or later available