{"id":"CVE-2026-42806","aliases":["EUVD-2026-75362","GHSA-wf7g-q2xv-vf8v"],"status":"published","title":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in...","description":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00205,"percentile":0.10612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-09-10T09:04:44Z","modified":"2026-09-10T16:17:12Z","products":[{"vendor":"bosch sensortec","product":"bme690 sensorapi (c)"}],"references":[{"url":"https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42806"},{"url":"https://github.com/advisories/GHSA-wf7g-q2xv-vf8v"}],"sources":{"cve":[{"id":"CVE-2026-42806","description":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.","status":"published","published":"2026-09-10T09:04:44.607Z","modified":"2026-09-10T15:00:50.874Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-75362","description":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.","status":"published","published":"2026-09-10T09:04:44Z","modified":"2026-09-10T15:00:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:24.501469Z"}],"ghsa":[{"id":"GHSA-wf7g-q2xv-vf8v","title":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in...","description":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\n\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\n\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\n\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\n\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\n\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.","status":"published","published":"2026-09-10T09:31:33Z","modified":"2026-09-10T09:31:38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:11:41.43854Z"}],"nvd":[{"id":"CVE-2026-42806","description":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.","status":"published","published":"2026-09-10T09:17:02.127Z","modified":"2026-09-10T16:17:12.27Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:45.93749Z"}]}}