EUVD-2026-75364
GHSA-p6fr-934x-xrhw
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical board connection via USB/BLE is mandatory (AV:P); no credentials required for the board to stream data; C:H/I:H/A:H reflects potential host OS-level code execution.
Primary rating from Vendor (bosch).
CVSS VectorVendor: bosch
Lifecycle Timeline
1DescriptionCVE.org
An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.
The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer.
Internally, the stream processing mechanism in {{comm_intf_process_stream_response()}} discards the requested {{number_of_samples}} argument and copies the entirety of the streaming ring buffer's accumulated data into {{coines_stream_rsp_buf}}.
Subsequently, {{coines_read_stream_sensor_data()}} unconditionally executes a {{memcpy}} of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough.
A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment.
This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.
AnalysisAI
Buffer overflow in Bosch Sensortec COINES SDK versions 2.0 through 2.11 allows a malicious or compromised sensor evaluation board, connected to a host machine via USB or BLE, to overflow the host application's heap or stack by streaming an excessive volume of sensor samples. The root cause is that coines_read_stream_sensor_data() unconditionally performs a memcpy of the full ring buffer content without verifying whether the caller-provided destination buffer can accommodate it, because the internal comm_intf_process_stream_response() silently discards the requested number_of_samples bound. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires physical access to connect a malicious or attacker-controlled hardware evaluation board to the target host via USB or BLE; remote network exploitation is not possible given AV:P. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.8 score with AV:P accurately reflects the mandatory physical access requirement - an attacker must control or supply a malicious hardware board connected over USB or BLE, which eliminates all opportunistic network-based exploitation paths. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Bosch PSIRT advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html for the vendor-released patch; no specific fixed version number was available in the input data, so patch availability must be confirmed directly with Bosch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today