Technical impact
A stack-based buffer overflow exists in the FIFO parsing and debug logging subsystem of the Bosch Sensortec BHI360 SensorAPI C‑Library when the first payload byte of a debug frame is blindly copied into a fixed 17‑byte stack buffer, allowing an attacker to overflow the buffer and corrupt return addresses. Because the overflowed data is subsequently handed to a printf‑style sink, the attacker can also supply format string specifiers to gain arbitrary code execution or trigger a controlled crash, resulting in integrity and availability loss.
Affected Systems
The vulnerability affects all installations of the BHI360 SensorAPI C‑Library using versions up to and including commit d6b200416a. This includes firmware running on microcontrollers or SoCs that rely on the library to parse debug frames from Bosch Sensortec BHI360 sensor modules, or from counterfeit hardware that mimics the sensor's interface.
Risk and Exploitability
The CVSS score of 7.6 indicates a high severity, while the lack of an EPSS score and absence from the CISA KEV catalog limit publicly known exploitation data. The attack requires an attacker to supply a crafted debug frame on the communication bus, which is feasible for physically or locally positioned adversaries such as a rogue sensor module or a man‑in‑the‑middle on the bus. Once the buffer is overflowed, the attacker can overwrite the return address to execute arbitrary code on the host microcontroller, or inject format string operations to cause a crash, both of which provide significant control over the embedded system.
