Three findings affect C drivers that a host processor uses to configure a BHI360, BHI385 or BME690 sensor and parse data received over I2C or SPI. Two affect COINES SDK, the development environment that connects a PC to Bosch evaluation boards over USB or Bluetooth Low Energy (BLE).

In each case, software trusts a length or index received across that hardware boundary. A malicious or compromised sensor, bus participant or evaluation board can use the missing validation to crash the host, disclose adjacent memory or, in the highest-impact cases described by Bosch, potentially execute code. Bosch’s highest CVSS v3.1 score in the set is 8.4 High [1].

The affected code runs on the host that integrates the library: an embedded MCU or SoC for the SensorAPIs, and normally a developer workstation for the COINES PC paths.

What Are These Projects?

Sensors need host-side software to configure registers, send commands and interpret the bytes they return. Bosch supplies two layers in the affected development paths:

1. A SensorAPI is a portable C driver integrated into a host MCU, SoC, Linux system or evaluation program. It translates application requests into sensor operations and parses data received from the device.
2. COINES SDK is the development and evaluation environment around Bosch’s Application Boards. It lets a developer configure sensors and collect their data from C or Python on a PC, or compile selected examples for the board’s own microcontroller [2] [3].

The four affected projects have different roles:

• COINES SDK, short for Communication with Inertial and Environmental Sensors, is Bosch’s evaluation SDK. Developers use its C API or Python interface to configure sensors and collect data through an Application Board [2] [3].
• BHI360 SensorAPI is the host driver for a programmable six-axis smart IMU used for orientation, gestures, activity detection, wearables and hearables [5] [6] [7].
• BHI385 SensorAPI drives a high-g smart IMU intended for sports motion, impact detection, sensor fusion and on-device AI workloads [8] [9] [10].
• BME690 SensorAPI configures and reads Bosch’s gas, pressure, humidity and temperature sensor. Documented uses include indoor air quality, unusual gas detection, appliances and wearables [11] [12] [13].

COINES normally runs on a Windows, Linux or macOS workstation connected to an Application Board 3.0 or 3.1. Selected C examples can also run directly on the board’s microcontroller. The SensorAPIs are portable C libraries integrated into the MCU, SoC or evaluation program that communicates with the sensor.

Advisory Map

CVE-2026-42804: BHI360 Debug FIFO Stack Overflow

bhi360_parse_debug_message() receives a debug event and treats its first payload byte as msg_length. In the affected code, that length controlled a memcpy() into a 17-byte stack buffer without first enforcing the 16-byte message limit [1].

A crafted length above 16 can overwrite adjacent stack data on the system running the SensorAPI. Bosch describes malicious sensors, counterfeit modules and a man-in-the-middle on the communication bus as example threat positions. The advisory lists denial of service and potential code execution among the consequences.

The advisory also discusses format specifiers reaching a printf-style logging path. Exploiting the bug for code execution depends on compiler protections, ABI, logging implementation, memory layout and privileges. The affected function performs an unchecked stack write regardless of those conditions.

CVE-2026-42805: BHI385 Debug FIFO Stack Overflow

The BHI385 issue follows the same pattern. bhi385_parse_debug_message() reads an eight-bit length from callback_info->data_ptr[0] and copies that many bytes into uint8_t debug_msg[17] without clamping the value [1].

Because the event originates in the sensor FIFO, the relevant trust boundary is again the host’s I2C/SPI input. A malicious or compromised sensor or another bus participant could provide an oversized debug event, causing a firmware or process crash and potentially corrupting control data on the stack.

CVE-2026-42806: BME690 Gas-index Out-of-bounds Read

The BME690 driver preloads three groups of heater settings into a 30-byte stack array. Field data contains a four-bit gas_index, so the encoded value can range from 0 to 15, while the heater tables contain ten valid entries indexed from 0 to 9 [1].

In affected versions, values from 10 to 15 were not rejected before the driver evaluated set_val[20 + gas_index]. This can read up to six bytes beyond the array. The resulting byte is exposed through the public gas_wait field, creating a measurement-integrity problem and a possible small disclosure of adjacent stack memory if the value is later logged or transmitted.

The bug reads beyond the array without writing to it. Bosch assigns it the lowest score in the set, CVSS 4.3 Medium.

CVE-2026-42807: COINES PC Bridge Heap Overflow

The COINES PC bridge decoder accepts a packet length supplied by an external device and forwards the response to mqueue_add_data(). Bosch reports that a connected USB or BLE device can advertise a payload of approximately 3 KB, while the default response-queue slot is 255 bytes [1].

Without a destination-capacity check, the subsequent memcpy() can overwrite heap memory in the desktop process. A malicious or compromised evaluation board or BLE peripheral can use this path to crash the process or potentially execute code on the developer workstation.

CVE-2026-42808: COINES Streaming Destination-buffer Overflow

The second COINES issue is in coines_read_stream_sensor_data(). The internal response handler did not preserve the caller’s requested number_of_samples as the effective copy boundary. It accumulated streaming data and later copied the ring-buffer content into the caller-provided destination without verifying that the destination was large enough [1].

A connected USB or BLE board capable of producing a sufficiently large stream can therefore trigger a heap or stack overflow in the host application. The concrete memory region depends on how the calling program allocated its destination buffer.

What the Git History Shows

Bug age does not change severity, but it shows how long vulnerable source could spread into downstream copies. The public history dates the BHI360 issue to 424 days, the BHI385 issue to 242 days before the fix commit and 276 days before the first patched tag, and the BME690 issue to 459 days.

The tags do not always match Bosch’s version guidance. The BHI360 debug parser is absent from public tag v2.1.0 and first appears in v2.2.0. The BME690 repository has no public v1.0.4 tag; its first public tag containing the fix is v1.1.0, although Bosch recommends v1.0.4 or later.

For COINES, retained history proves that the streaming path remained vulnerable for at least 619 days, but does not cover Bosch’s full affected range back to 2019 [16]. The first public PC bridge guard also leaves queue_mutex locked, and the relevant C files are identical in tags 2.12.2 and 2.12.3 even though the prebuilt libraries and firmware differ [15]. Teams should therefore verify the exact host library and board firmware in use.

Exposure and Remediation

Bosch’s CVSS vectors require physical, local or adjacent access [1]. The relevant attacker positions are a malicious or compromised sensor, another participant on the I2C or SPI bus, or an Application Board, USB device or BLE peripheral connected to a development machine. A downstream product could add a remote route to one of those interfaces, but BOSCH-SA-223618 does not document such a chain.

Bosch recommends current BHI360 and BHI385 SensorAPI updates, BME690 SensorAPI v1.0.4 or later, and COINES SDK v2.12.3 or later [1]. Integrators should also:

• inventory copied or vendored SensorAPI source instead of relying on package names;
• verify the exact COINES host library and board firmware in use;
• test oversized debug messages, invalid gas_index values and streams larger than the caller’s destination buffer.

Disclosure Timeline

We thank the Bosch PSIRT team for their collaboration throughout the disclosure process and for recognizing us in their 2026 Products Hall of Fame [17].

References

• [1] Bosch PSIRT. “Vulnerabilities in Bosch Sensortec SensorAPIs and COINES SDK.” BOSCH-SA-223618, published August 31, 2026. Security advisory

• [2] Bosch Sensortec. “COINES SDK — Communication with Inertial and Environmental Sensors.” Official GitHub repository

• [3] Bosch Sensortec. “Application Board.” Product and development-platform overview

• [4] Bosch Sensortec. “BHy2xx/BHI3xx Evaluation Setup Guide.” BST-BHY2xx-BHI3xx-AN001. Application note

• [5] Bosch Sensortec. “BHI360 SensorAPI.” Official GitHub repository

• [6] Bosch Sensortec. “Smart sensor: BHI360.” Product page

• [7] Bosch Sensortec. “BHI360 Datasheet.” BST-BHI360-DS000. Datasheet

• [8] Bosch Sensortec. “BHI385 SensorAPI.” Official GitHub repository

• [9] Bosch Sensortec. “Smart sensor: BHI385.” Product page

• [10] Bosch Sensortec. “BHI385 Datasheet.” BST-BHI385-DS000. Datasheet

• [11] Bosch Sensortec. “BME690 SensorAPI.” Official GitHub repository

• [12] Bosch Sensortec. “Gas sensor BME690.” Product page

• [13] Bosch Sensortec. “BME690 Datasheet.” BST-BME690-DS001. Datasheet

• [14] Email correspondence between SecMate and Bosch PSIRT regarding BOSCH-SA-223618, November 11, 2025 to August 6, 2026. On file.

• [15] Bosch Sensortec. Comparison of COINES SDK 2.12.2 and 2.12.3. The public source comparison changes release metadata, prebuilt libraries and firmware, but not the four C files involved in the two findings. GitHub comparison

• [16] Bosch Sensortec. “COINES SDK Release Notes.” Dates 2.0 to May 27, 2019, 2.10 to November 20, 2024, 2.12 to December 1, 2025 and 2.12.3 to June 8, 2026. Release notes at tag 2.12.3

• [17] Bosch PSIRT. “Bosch Products Hall of Fame.” The 2026 entries recognize Maxime Rossi Bellom and Ramtine Tofighi Shirazi of SecMate. Bosch Products Hall of Fame

The SecMate Team