Read the docs
TI-2026-31026 Aliases CVE-2026-42808GHSA-p6fr-934x-xrhw

Buffer overflow in Bosch Sensortec COINES_SDK

Priority LOW 32CWE-120Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.  The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in {{comm_intf_process_stream_response()}} discards the requested {{number_of_samples}} argument and copies the entirety of the streaming ring buffer's accumulated data into {{coines_stream_rsp_buf}}. Subsequently, {{coines_read_stream_sensor_data()}} unconditionally executes a {{memcpy}} of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough. A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment. This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bosch SensortecCOINES_SDK2.0 – 2.11—No fix listedCNA
  • COINES_SDK VendorBosch Sensortec Affected 2.0 – 2.11 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Bosch Sensortec COINES_SDK — psirt.bosch.com/security-advisories/BOSCH-SA-223618.html

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-31025 Heap-based buffer overflow in Bosch Sensortec COINES_SDKPriority LOW 37
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42808
  2. 2026-10-03 Alias added: GHSA-p6fr-934x-xrhw

References

Advisory 1

  • TI-2026-31023 Stack-based buffer overflow in Bosch Sensortec BHI385 SensorAPI CVSS 3.1HIGH 8.4
  • TI-2026-31025 Heap-based buffer overflow in Bosch Sensortec COINES_SDK CVSS 3.1HIGH 8.0
  • TI-2026-31022 Stack-based buffer overflow in Bosch Sensortec BHI360_SensorAPI CVSS 3.1HIGH 7.6
  • TI-2026-31024 Out-of-bounds read in Bosch Sensortec BME690 SensorAPI CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences