The COINES_SDK streaming API function fails to validate the size of the destination buffer before performing a memcpy. Because the internal buffer size is copied regardless of the caller’s requested sample count, an attacker can supply a low‑capacity buffer and invoke the API with a large request. This results in a heap or stack based buffer overflow, which can terminate the host application or, if control can be gained, lead to arbitrary code execution. The weakness is a classic unchecked input scenario.

Bosch Sensortec devices using the COINES_SDK product, specifically versions 2.0 through 2.11. These versions expose the vulnerable read_stream_sensor_data() API and the underlying buffer handling routine.

The vulnerability has a CVSS score of 6.8. No EPSS data is available and the issue is not currently listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The likely exploit requires a malicious or compromised sensor board that can connect to the host via USB or BLE and generate an unusually high volume of sensor samples. While this limits the attack surface to scenarios where an attacker has control over or physical access to the hardware, the potential impact of a successful overflow—Denial of Service or code execution on the host—remains significant.