CVE-2026-42806
Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Bosch BME690 SensorAPI

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Robert Bosch GmbH

Description
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c). The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables. When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9). An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher. This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer. The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-42806
EUVD
EUVD-2026-75362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bosch bme690_sensorapi to v1.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in the Bosch BME690 SensorAPI (C-driver) versions up to v1.0.3. It occurs during sensor field data parsing when a gas index value of 10 or higher is processed. The driver uses a 4-bit mask to extract the gas index but fails to validate it against the valid range of 0 to 9. This allows an attacker or compromised peripheral to trigger an out-of-bounds array access, reading up to 6 bytes past a stack buffer and potentially leaking adjacent memory.

Detection Guidance

This vulnerability is specific to the Bosch BME690 SensorAPI and requires access to the I2C/SPI bus where the sensor communicates. Detection involves monitoring for out-of-bounds gas index values during sensor field data parsing. Check Bosch's official advisory for updated firmware versions and review sensor communication logs for invalid gas index values (10 or higher).

Commands may include checking sensor driver logs, monitoring I2C/SPI bus traffic for malformed payloads, and verifying the sensor firmware version against the patched release.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data, leading to information disclosure or corruption of sensor measurements. If exploited, it may cause measurement inaccuracies or expose internal system data through logged or telemetered sensor outputs. The impact is limited to systems using the affected Bosch BME690 SensorAPI driver.

Compliance Impact

This vulnerability may impact compliance with standards like GDPR and HIPAA by potentially exposing sensitive data through memory leaks. Out-of-bounds reads could leak stack memory, including sensor data or adjacent variables, which might contain personal or health information if processed by the sensor system. This could violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Mitigation Strategies

Update the Bosch BME690 SensorAPI to a version newer than v1.0.3 to address the out-of-bounds read vulnerability in the field data parsing logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart