A stack-based buffer overflow in the BHI385 SensorAPI debug message parser allows an attacker to control the length byte of a payload, causing a memcpy into a fixed‑size 17‑byte buffer to write past the boundary. The resulting memory corruption can crash the firmware, produce a denial of service, or, if adjacent stack data is overwritten, lead to execution of attacker‑supplied code. The flaw is present in the parsing function bhi385_parse_debug_message and is triggered by data received via a callback tied to the sensor’s FIFO events.

The vulnerability affects the Bosch Sensortec BHI385 SensorAPI C library, which is used in sensor firmware that processes debug messages from the BHI385 sensor module. No specific vendor version is listed in the advisories, so users should check the firmware revision of their devices against the Bosch PSIRT release notes for a fix.

With a CVSS score of 8.4 the vulnerability is classified as high severity. No EPSS score is available and it is not yet listed in the CISA KEV catalog. The likely attack vector is a compromised sensor or bus participant that can send crafted payloads to the device. An attacker with access to the sensor data stream can exploit the unchecked length byte to overflow the stack and potentially take control of the firmware process.