Executive brief
Bosch's COINES SDK is a software library used by developers to communicate with and control embedded sensor modules and hardware boards. A malicious or compromised sensor board connected via USB or Bluetooth can send excessive streaming data to exploit a buffer overflow in the host application, potentially crashing the desktop system or allowing an attacker to run arbitrary code on the developer's machine.
Technical details
CVE-2026-42808 is a heap/stack buffer overflow vulnerability in the coines_read_stream_sensor_data() function within Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The root cause is insufficient boundary validation: the internal stream processing discards the requested sample count and copies the entire ring buffer into a fixed-size buffer, then unconditionally performs a memcpy into a caller-provided destination without verifying its size. An attacker can trigger this by connecting a malicious or compromised USB/BLE sensor board that streams a high volume of samples. Exploitation results in heap or stack memory corruption, enabling denial of service or arbitrary code execution on the host desktop. Patches are available in COINES SDK version 2.12.3 or higher.
Affected products
- Bosch Sensortec COINES_SDK 2.0 through 2.11
Timeline
- 2026-09-10: disclosed
- 2026-08-31: patched: Patches released in COINES SDK 2.12.3 or higher