The vulnerability is a classic out-of-bounds read within the BME690 SensorAPI driver. During sensor field data parsing, a gas index is extracted with a 4‑bit mask but no check ensures it stays within the valid 0–9 range. An attacker who can expose a fabricated sensor on the I2C/SPI bus may supply a gas index of 10 or higher, causing the driver to read up to six bytes beyond a 30‑byte stack buffer. The leaked byte is written into the public gas_wait field, which can corrupt measurement values or expose adjacent stack memory in logs or telemetry. The primary consequence is potential confidentiality loss of stack contents and integrity loss of sensor output.

The affected systems are devices that use Bosch Sensortec’s BME690 SensorAPI C driver, specifically version 1.0.3 and earlier. These are embedded sensor platforms that interface over I2C or SPI.

Risk and exploitability are moderate. The CVSS score of 4.3 reflects limited impact beyond data corruption. EPSS data is unavailable. The KEV status is not listed. The description indicates that an attacker must have a trusted peripheral that can mimic a sensor on the same bus; therefore, the attack vector is inferred to be local, not remote. As such, the threat is significant for systems where sensor data integrity is critical, but exploitation demands physical or compromised peripheral access.