EUVD-2026-75363
GHSA-m73h-r7p8-3rvm
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent vector for USB/BLE proximity; no attacker privileges needed; user must actively pair or connect (UI:R); full impact plausible via RCE from controlled heap overflow.
Primary rating from Vendor (bosch).
CVSS VectorVendor: bosch
Lifecycle Timeline
2DescriptionCVE.org
A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code.
The bridge decoder ({{bridge_decoder.c}}) trusts the packet length field provided by the external device and forwards it to the host response queue ({{mqueue_add_data}}) without validating the bounds of the destination buffer.
A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral can advertise a payload size up to ~3 KB, which exceeds the default queue slot size of 255 bytes.
This results in an unbounded heap overwrite ({{memcpy}}), corrupting adjacent heap metadata on the host system when processing the device's response.
AnalysisAI
Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim host to be running COINES_SDK version 2.10 through 2.12.2 and the user to actively connect or pair with an attacker-controlled peripheral device - either via USB cable (physical access) or BLE (within radio range, typically under 100 metres). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.0 with vector AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H represents a realistic characterisation of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Bosch PSIRT advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html for the vendor-released patched version; the input data does not specify an exact fixed release number beyond stating that versions 2.10 through 2.12.2 are affected, so an upgrade to the next available release should be verified against the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all development teams and machines running COINES_SDK versions 2.10-2.12.2 and create an inventory of affected workflows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today