CVE-2026-42807

A heap-based buffer overflow (CWE-122) exists in the PC bridge protocol decoder of BoschSensortec COINES_SDK versions 2.10 through 2.12.2, where the decoder trusts the packet length field supplied by an external device and copies it into a 255-byte host response queue slot without bounds checking. A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral connected to the host can advertise a response payload of up to roughly 3 KB, causing an unbounded memcpy that overwrites adjacent heap metadata and can crash the process or potentially execute arbitrary code. At minimum an attacker gains denial of service, with potential arbitrary code execution on the host system running the SDK bridge tooling. Affected users are developers and engineers running COINES_SDK 2.10-2.12.2 on host machines that communicate with sensor evaluation hardware over USB or BLE. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known.

What to do: Upgrade COINES_SDK to a release newer than 2.12.2 as soon as Bosch publishes a fixed version, and monitor the Bosch PSIRT advisory for the patched release. Until patched, only connect trusted USB or BLE peripherals to hosts running the bridge decoder and treat connected evaluation boards as an untrusted input source. Because exploitation requires a malicious or compromised adjacent device, restricting bridge connections to known hardware in development environments substantially limits exposure.