EUVD-2026-75329
GHSA-6jqh-27cv-xqr6
Severity by source
AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Physical bus access required to inject the malicious sensor frame; scope change appropriate as the impacted system is the host MCU, distinct from the sensor peripheral supplying the payload.
Primary rating from Vendor (bosch).
CVSS VectorVendor: bosch
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.
The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875).
The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking.
A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16.
This corrupts adjacent stack data, including the saved return address.
Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).
AnalysisAI
Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in bhi360_parse_debug_message(), corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for %n-style exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires physical or bus-adjacent access to the sensor communication interface (typically I²C or SPI) of a target device running the affected BHI360 SensorAPI library - achieved by substituting a malicious or counterfeit BHI360 sensor, installing a hardware bus interposer, or mounting a Man-in-the-Middle attack on the physical sensor bus. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate, bounded primarily by the physical access requirement (CVSS AV:P), which eliminates any purely remote network exploitation path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the BHI360 SensorAPI to a commit or release version beyond d6b200416a once Bosch Sensortec publishes a confirmed patched build; monitor the advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html for the exact fixed version, which is not confirmed in the currently available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all products and systems using the Bosch Sensortec BHI360 SensorAPI C-Library to assess organizational exposure and identify critical deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today