CVE-2026-42806
Received Received - Intake

Out-of-Bounds Read in Bosch BME690 SensorAPI

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Robert Bosch GmbH

Description
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c). The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables. When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9). An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher. This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer. The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-42806
EUVD
EUVD-2026-75362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bosch bme690_sensorapi to v1.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in the Bosch BME690 SensorAPI (C-driver) versions up to v1.0.3. It occurs during sensor field data parsing when a gas index value of 10 or higher is processed. The driver uses a 4-bit mask to extract the gas index but fails to validate it against the valid range of 0 to 9. This allows an attacker or compromised peripheral to trigger an out-of-bounds array access, reading up to 6 bytes past a stack buffer and potentially leaking adjacent memory.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data, leading to information disclosure or corruption of sensor measurements. If exploited, it may cause measurement inaccuracies or expose internal system data through logged or telemetered sensor outputs. The impact is limited to systems using the affected Bosch BME690 SensorAPI driver.

Mitigation Strategies

Update the Bosch BME690 SensorAPI to a version newer than v1.0.3 to address the out-of-bounds read vulnerability in the field data parsing logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart