CVE-2026-42805

CVE-2026-42805 is a stack-based buffer overflow (CWE-121) in the debug message parser bhi385_parse_debug_message of the Bosch Sensortec BHI385 SensorAPI C library (bhi385_parse.c), which reads an 8-bit message length directly from an attacker-controlled FIFO event payload and copies that many bytes via memcpy into a fixed 17-byte stack buffer without any bounds check or clamping. Any length byte greater than 16 writes past the stack buffer, corrupting adjacent stack data. A malicious or compromised sensor or other participant on the sensor bus (a local attack vector per the CVSS AV:L score of 8.4) can trigger the flaw to crash device firmware (denial of service) and, depending on the memory layout, potentially achieve arbitrary code execution. Affected parties are device makers and firmware integrators who compile bhi385_parse.c into products built around the BHI385 smart sensor hub, and by extension the end users of those devices. There is no public proof of concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is known.

What to do: Follow the Bosch Sensortec PSIRT advisory for CVE-2026-42805 and rebuild affected firmware against a corrected bhi385_parse.c (no fixed version number is given in the available data, so consult the vendor advisory for the patched release). As an interim mitigation, clamp or validate the debug-message length byte to a maximum of 16 before the memcpy in bhi385_parse_debug_message, or suppress handling of debug FIFO events from untrusted sensors. Audit your firmware tree for inclusion of bhi385_parse.c and consider whether any component on the sensor bus (including third-party or replaceable sensors) could be malicious or compromised.