CVE-2026-42806

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42806", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "state": "PUBLISHED", "assignerShortName": "bosch", "dateReserved": "2026-04-30T08:03:11.875Z", "datePublished": "2026-09-10T09:04:44.607Z", "dateUpdated": "2026-09-10T15:00:50.874Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2026-09-10T09:04:44.607Z"}, "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged."}], "affected": [{"vendor": "Bosch Sensortec", "product": "BME690 SensorAPI (C)", "versions": [{"version": "1.0.1", "status": "affected", "versionType": "custom", "lessThanOrEqual": "1.0.3"}]}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "CWE-125 Out-of-bounds Read", "cweId": "CWE-125"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T15:00:33.822497Z", "id": "CVE-2026-42806", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T15:00:50.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42806", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T15:00:33.822497Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T15:00:43.115Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Bosch Sensortec", "product": "BME690 SensorAPI (C)", "versions": [{"status": "affected", "version": "1.0.1", "versionType": "custom", "lessThanOrEqual": "1.0.3"}]}], "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html", "name": "https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "shortName": "bosch", "dateUpdated": "2026-09-10T09:04:44.607Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42806", "state": "PUBLISHED", "dateUpdated": "2026-09-10T15:00:50.874Z", "dateReserved": "2026-04-30T08:03:11.875Z", "assignerOrgId": "c95f66b2-7e7c-41c5-8f09-6f86ec68659c", "datePublished": "2026-09-10T09:04:44.607Z", "assignerShortName": "bosch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "BME690 SensorAPI (C)", "vendor": "Bosch Sensortec", "versions": [{"lessThanOrEqual": "1.0.3", "status": "affected", "version": "1.0.1", "versionType": "custom"}]}], "source": "psirt@bosch.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged."}], "id": "CVE-2026-42806", "lastModified": "2026-09-10T16:17:12.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "psirt@bosch.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42806", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T15:00:33.822497Z", "version": "2.0.3"}}]}, "published": "2026-09-10T09:17:02.127", "references": [{"source": "psirt@bosch.com", "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html"}], "sourceIdentifier": "psirt@bosch.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@bosch.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.1,1.0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BME690 SensorAPI (C)", "source": "cna", "vendor": "Bosch Sensortec"}, "product": "bme690_sensorapi_(c)", "vendor": "bosch_sensortec"}], "created": "2026-09-10T11:00:10.312359+00:00", "title": "Out\u2011of\u2011Bounds Read in BME690 SensorAPI Leading to Sensor Data Corruption", "updated": "2026-09-13T20:01:26.528288+00:00", "vendors": ["bosch_sensortec", "bosch_sensortec$PRODUCT$bme690_sensorapi_(c)"]}