EUVD-2026-75361
GHSA-7h94-3r4w-8qw8
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:L reflects sensor bus access requirement; PR:N because attack originates from hardware side, not OS-level credentials; full C/I/A from stack takeover potential.
Primary rating from Vendor (bosch).
CVSS VectorVendor: bosch
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in bhi385_parse.c).
The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without enforcing bounds checks or clamping the value.
When copying the payload into a fixed-size stack buffer of 17 bytes (uint8_t debug_msg[17]) via memcpy, providing a length byte greater than 16 causes the function to write past the allocated stack boundary.
This memory corruption can be triggered by a malicious or compromised sensor or bus participant, leading to a firmware crash, Denial of Service (DoS), or potentially the execution of arbitrary code via adjacent stack data corruption.
AnalysisAI
Stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI C library allows a malicious or compromised sensor or bus participant to corrupt host firmware stack memory, leading to denial of service or arbitrary code execution. The flaw resides in bhi385_parse_debug_message() (bhi385_parse.c), which reads an 8-bit message length directly from the attacker-controlled FIFO event payload and passes it unchecked to memcpy targeting a fixed 17-byte stack buffer - any length byte above 16 overwrites adjacent stack data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control a participant on the physical or logical sensor communication bus (I2C or SPI) connected to the host system running the BHI385 SensorAPI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4 and classifies this as a local, low-complexity, privilege-free attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Bosch PSIRT advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html for the vendor-released patched version of the BHI385 SensorAPI - the exact fixed library version was not extracted from the available data and should not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all deployments of Bosch Sensortec BHI385 sensors and retrieve the BOSCH-SA-223618 advisory for full technical details. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today