CVE-2026-42804: Bosch BHI360 Buffer Overflow Vulnerability

CVE-2026-42804 Overview

CVE-2026-42804 is a stack-based buffer overflow [CWE-121] in the Bosch Sensortec BHI360 SensorAPI (C-Library) affecting versions up to and including commit d6b200416a. The flaw resides in the FIFO parsing and debug logging subsystem, specifically in the bhi360_parse_debug_message() function within bhi360_parse.c. An attacker with local or physical access to the sensor communication bus can inject a crafted debug frame to overwrite the saved return address on the stack. Because the overflowed buffer is passed to a printf-style logging sink, the attacker can also supply format string specifiers such as %n to achieve arbitrary code execution on the host microcontroller or SoC.

Critical Impact
Successful exploitation enables arbitrary code execution on the host microcontroller/SoC or a reliable denial of service through stack corruption.

Affected Products

Bosch Sensortec BHI360 SensorAPI (C-Library)
All revisions up to and including commit d6b200416a
Host microcontrollers and SoCs integrating the affected SensorAPI

Discovery Timeline

2026-09-10 - CVE-2026-42804 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-42804

Vulnerability Analysis

The defect exists in bhi360_parse_debug_message() in bhi360_parse.c at lines 1852-1875. The parser treats the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer named debug_msg using memcpy. No bounds check compares msg_length against the destination buffer size. A frame declaring a length byte greater than 16 overwrites adjacent stack data, including the saved return address.

The vulnerability compounds because the populated buffer is subsequently passed to a printf-style logging sink. Attacker-controlled bytes therefore become the format string, enabling both memory disclosure through specifiers like %x and arbitrary write primitives through %n. This transforms a straightforward stack overflow into a reliable path to arbitrary code execution on the host processor.

Root Cause

The root cause is missing input validation on attacker-influenced length metadata before a memcpy into a fixed-size stack buffer, combined with the unsafe use of untrusted data as a format string in downstream logging.

Attack Vector

Exploitation requires local or physical positioning on the sensor communication bus. Attack scenarios include a malicious or counterfeit sensor module, a hardware implant, or a Man-in-the-Middle device on the I2C or SPI bus connecting the BHI360 to the host controller. The attacker sends a debug frame whose first payload byte exceeds 16 and whose payload contains format string specifiers, corrupting the stack and pivoting control flow on the host.

No verified public exploit code is available. Refer to the Bosch Security Advisory BOSCH-SA-223618 for vendor technical details.

Detection Methods for CVE-2026-42804

Indicators of Compromise

Debug frames on the sensor bus where the first payload byte exceeds 0x10 (16 decimal), indicating an out-of-bounds length.
Log output containing unexpected format specifier artifacts such as stray %n, %x, or %s sequences originating from sensor debug messages.
Unexpected resets, watchdog trips, or hard faults on the host microcontroller correlated with sensor traffic.

Detection Strategies

Instrument the SensorAPI to log and reject debug frames whose declared length exceeds the destination buffer size.
Perform bus-level protocol analysis with a logic analyzer to identify malformed debug frame headers during integration testing.
Add firmware-side canaries or stack protection (-fstack-protector-strong) to surface overflow attempts at runtime.

Monitoring Recommendations

Monitor host telemetry for anomalous reboots, exception handlers firing, or memory faults tied to sensor I/O.
Track supply chain provenance for BHI360 modules and validate hardware authenticity before deployment.
Review firmware build reports to confirm the affected SensorAPI commit is not present in shipped images.

How to Mitigate CVE-2026-42804

Immediate Actions Required

Inventory all firmware builds that link against the Bosch Sensortec BHI360 SensorAPI at or before commit d6b200416a.
Apply the vendor patch referenced in the Bosch PSIRT advisory and rebuild affected firmware images.
Restrict physical access to devices containing the BHI360 and validate integrity of sensor modules during manufacturing and servicing.

Patch Information

Bosch has published guidance in Bosch Security Advisory BOSCH-SA-223618. Integrators should update the SensorAPI to a fixed revision beyond commit d6b200416a and redeploy firmware to all affected devices.

Workarounds

Disable the debug message parsing path in bhi360_parse_debug_message() if debug logging is not required in production builds.
Add a defensive bounds check that rejects frames where msg_length exceeds the 17-byte debug_msg buffer prior to memcpy.
Replace the printf-style sink with a fixed format string (printf("%s", debug_msg)) to neutralize format string exploitation even if overflow occurs.
Enforce authenticated or filtered sensor communication where the host controller can validate frame provenance before parsing.

bash

# Compiler hardening flags recommended when rebuilding firmware
CFLAGS="-fstack-protector-strong -Wformat -Wformat-security -Werror=format-security"