The Bosch Sensortec BHI360 SensorAPI C-Library contains a stack-based buffer overflow vulnerability (CWE-121) in the function bhi360_parse_debug_message() within bhi360_parse.c. The vulnerability arises because the parser trusts the first payload byte of a debug frame as the message length and copies that many bytes into a fixed 17-byte stack buffer without verifying bounds. This allows a locally or physically positioned attacker—such as one controlling a malicious sensor, counterfeit hardware module, or performing a man-in-the-middle attack on the communication bus—to inject a debug frame with a length byte greater than 16. This overflow corrupts adjacent stack data including the saved return address. Additionally, the overflowed buffer is passed to a printf-style logging function, enabling exploitation through format string specifiers like %n, which can lead to arbitrary code execution on the host microcontroller or a reliable system crash (denial of service).

Successful exploitation can lead to complete compromise of the host microcontroller or SoC by executing arbitrary code with potentially high privileges. Alternatively, it can cause a denial of service by crashing the system. The vulnerability requires local or physical access to the device or communication bus, limiting remote exploitation. The CVSS 3.1 base score is 7.6 (High), reflecting high confidentiality, integrity, and availability impacts with low attack complexity but requiring physical proximity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, mitigate risk by restricting physical and local access to the affected devices and communication buses. Avoid using untrusted or counterfeit hardware modules and sensors. Monitor vendor channels for updates and apply patches promptly once released.