CVE-2026-42807 is a heap-based buffer overflow vulnerability in the PC bridge protocol decoder component (bridge_decoder.c) of BoschSensortec COINES_SDK versions 2.10 through 2.12.2. The decoder forwards the packet length field from an external device directly to the host response queue function (mqueue_add_data) without bounds checking. An attacker controlling a USB or Bluetooth Low Energy peripheral can send a payload up to approximately 3 KB, exceeding the default queue slot size of 255 bytes. This causes an unbounded memcpy operation that overwrites adjacent heap metadata on the host, potentially leading to process crashes or arbitrary code execution.

Successful exploitation can cause denial of service by crashing the affected process or potentially allow arbitrary code execution on the host system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting untrusted or potentially compromised USB or BLE peripherals to systems running affected versions of COINES_SDK. Monitor vendor channels for updates and apply official patches once released.