CVE-2026-42804

A stack-based buffer overflow (CWE-121) exists in the FIFO parsing and debug logging code of the Bosch Sensortec BHI360 SensorAPI C library: bhi360_parse_debug_message() in bhi360_parse.c trusts the first payload byte of a debug frame as a length and copies that many bytes into a fixed 17-byte stack buffer without bounds checking. An attacker who is locally or physically positioned - via a malicious or counterfeit sensor module or a man-in-the-middle on the communication bus - can inject a crafted debug frame with a length byte greater than 16 to trigger the overflow. The overflow corrupts adjacent stack data including the saved return address, and because the buffer is subsequently passed to a printf-style logging sink, injected format specifiers (e.g., %n) can yield arbitrary code execution on the host microcontroller/SoC or a reliable crash (denial of service). Any host firmware that embeds the affected SensorAPI code (up to and including commit d6b200416a) to parse BHI360 FIFO data is exposed; the physical attack vector limits practical risk to devices where an attacker can tamper with the sensor or its bus. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of now.

What to do: Rebuild host firmware with a SensorAPI revision newer than commit d6b200416a as soon as Bosch Sensortec publishes a patched commit, and monitor the Bosch Sensortec GitHub repository and the BOSCH PSIRT advisory for the fix. As interim mitigations, add bounds checking on the debug frame length byte (cap it at 16 bytes) before the memcpy into debug_msg, or disable/skip debug-frame parsing in production builds. Check whether your firmware includes bhi360_parse_debug_message() from bhi360_parse.c and whether the sensor bus is physically accessible to tamper or counterfeit hardware.