Executive brief
The Bosch BME690 SensorAPI is a driver library used in environmental sensor modules to read temperature, humidity, and gas composition data. A malicious or compromised sensor device can cause the driver to read memory past the boundary of a stack buffer, potentially leaking adjacent stack data to the application logs or telemetry output, corrupting sensor readings, or exposing sensitive information stored on the microcontroller's memory.
Technical details
The vulnerability is an out-of-bounds read in the read_all_field_data() function in bme69x.c. The driver extracts a 4-bit gas_index value (0–15) from sensor responses but only validates against a valid range of 0–9. When gas_index is ≥10, the code accesses set_val[20 + gas_index], reading up to 6 bytes past a 30-byte stack buffer. The leaked byte is then written to the public gas_wait output field. Attack vector is physical or adjacent (I2C/SPI bus); a compromised sensor or Man-in-the-Middle can inject a malicious payload. The impact is information disclosure (stack memory leak) or measurement corruption. A fix is available in version v1.0.4 or later.
Affected products
- Bosch Sensortec BME690 SensorAPI 1.0.1 to 1.0.3
Timeline
- 2026-09-10: disclosed
- 2026-08-31: patched: v1.0.4 or higher available