The vulnerability is a heap‑based buffer overflow in the COINES_SDK PC bridge protocol decoder. The decoder does not verify the packet length field supplied by an external device and copies data directly into a fixed‑size host response queue using memcpy. An attacker can send a payload up to approximately 3 KB from a malicious USB or BLE peripheral, exceeding the queue slot size of 255 bytes. The resulting unbounded memory write corrupts heap metadata, causing the SDK process to crash, which is a denial of service, or potentially facilitating arbitrary code execution on the host. This represents a classic heap manipulation flaw (CWE‑122).

Affected products are Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2. The vulnerability exists in the host component that processes incoming USB or BLE data via the PC bridge protocol decoder. Systems that integrate this SDK to communicate with external peripherals are impacted. No additional vendor products are listed.

The CVSS base score of 8 indicates high severity. The exploitation probability is not quantified because EPSS data is not available, and the flaw is not in the CISA KEV catalog. The attack requires a malicious or compromised USB or BLE peripheral that can present an oversized payload to a host running the affected SDK. Physical proximity or the ability to emulate a peripheral makes this feasible; the lack of input validation provides a straightforward memory corruption path. If exploited successfully, an attacker could force the SDK to terminate or, with careful construction, inject code into the host process.