Read the docs
TI-2026-31025 Aliases CVE-2026-42807GHSA-m73h-r7p8-3rvm

Heap-based buffer overflow in Bosch Sensortec COINES_SDK

Priority LOW 37CWE-122Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The bridge decoder ({{bridge_decoder.c}}) trusts the packet length field provided by the external device and forwards it to the host response queue ({{mqueue_add_data}}) without validating the bounds of the destination buffer. A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral can advertise a payload size up to ~3 KB, which exceeds the default queue slot size of 255 bytes. This results in an unbounded heap overwrite ({{memcpy}}), corrupting adjacent heap metadata on the host system when processing the device's response.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bosch SensortecCOINES_SDK2.10 – 2.12.2—No fix listedCNA
  • COINES_SDK VendorBosch Sensortec Affected 2.10 – 2.12.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Bosch Sensortec COINES_SDK — psirt.bosch.com/security-advisories/BOSCH-SA-223618.html

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-31026 Buffer overflow in Bosch Sensortec COINES_SDKPriority LOW 32
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42807
  2. 2026-10-03 Alias added: GHSA-m73h-r7p8-3rvm

References

Advisory 1

  • TI-2026-31023 Stack-based buffer overflow in Bosch Sensortec BHI385 SensorAPI CVSS 3.1HIGH 8.4
  • TI-2026-31022 Stack-based buffer overflow in Bosch Sensortec BHI360_SensorAPI CVSS 3.1HIGH 7.6
  • TI-2026-31026 Buffer overflow in Bosch Sensortec COINES_SDK CVSS 3.1MEDIUM 6.8
  • TI-2026-31024 Out-of-bounds read in Bosch Sensortec BME690 SensorAPI CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences